BIP-0376: refactor reference

Author: lucia-w

bip-0376.mediawiki

@@ -147,6 +147,7 @@ These are new fields added to the existing PSBT format. Because PSBT is designed
 == Reference implementation ==
 
 A Python reference implementation is provided in [[bip-0376/reference.py|<code>bip-0376/reference.py</code>]].
+It uses the vendored <code>secp256k1lab</code> test-only secp256k1 implementation from BIP 374 for elliptic curve arithmetic and BIP 340 signing.
 
 It demonstrates the Signer behavior specified in this BIP:
 
@@ -161,7 +162,7 @@ Machine-readable test vectors are provided in [[bip-0376/test-vectors.json|<code
 
 The vector set includes:
 
-* Valid cases with and without key negation.
+* Valid signing cases with and without key negation.
 * Invalid cases for output-key mismatch, zero tweaked key, and out-of-range spend key.
 
 The reference implementation can be run against the vectors with:

bip-0376/reference.py

@@ -7,116 +7,13 @@
 
 import json
 import sys
-import hashlib
 from pathlib import Path
-from typing import Optional, Tuple
 
-p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
-n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
-G = (
-    0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798,
-    0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8,
-)
-
-Point = Tuple[int, int]
-
-
-def tagged_hash(tag: str, msg: bytes) -> bytes:
-    tag_hash = hashlib.sha256(tag.encode("utf-8")).digest()
-    return hashlib.sha256(tag_hash + tag_hash + msg).digest()
-
-
-def int_from_bytes(data: bytes) -> int:
-    return int.from_bytes(data, byteorder="big")
-
-
-def bytes_from_int(x: int) -> bytes:
-    return x.to_bytes(32, byteorder="big")
-
-
-def has_even_y(P: Point) -> bool:
-    return (P[1] % 2) == 0
-
-
-def bytes_from_point(P: Point) -> bytes:
-    return bytes_from_int(P[0])
-
-
-def xor_bytes(a: bytes, b: bytes) -> bytes:
-    return bytes(x ^ y for (x, y) in zip(a, b))
-
-
-def lift_x(x_coord: int) -> Optional[Point]:
-    if x_coord >= p:
-        return None
-    y_sq = (pow(x_coord, 3, p) + 7) % p
-    y_coord = pow(y_sq, (p + 1) // 4, p)
-    if pow(y_coord, 2, p) != y_sq:
-        return None
-    return (x_coord, y_coord if (y_coord % 2) == 0 else p - y_coord)
-
-
-def point_add(P1: Optional[Point], P2: Optional[Point]) -> Optional[Point]:
-    if P1 is None:
-        return P2
-    if P2 is None:
-        return P1
-    if (P1[0] == P2[0]) and (P1[1] != P2[1]):
-        return None
-    if P1 == P2:
-        lam = (3 * P1[0] * P1[0] * pow(2 * P1[1], p - 2, p)) % p
-    else:
-        lam = ((P2[1] - P1[1]) * pow(P2[0] - P1[0], p - 2, p)) % p
-    x3 = (lam * lam - P1[0] - P2[0]) % p
-    y3 = (lam * (P1[0] - x3) - P1[1]) % p
-    return (x3, y3)
-
-
-def point_mul(P: Optional[Point], scalar: int) -> Optional[Point]:
-    R = None
-    for i in range(256):
-        if (scalar >> i) & 1:
-            R = point_add(R, P)
-        P = point_add(P, P)
-    return R
-
-
-def schnorr_verify(msg: bytes, pubkey: bytes, sig: bytes) -> bool:
-    if len(pubkey) != 32 or len(sig) != 64:
-        return False
-    P = lift_x(int_from_bytes(pubkey))
-    r = int_from_bytes(sig[0:32])
-    s = int_from_bytes(sig[32:64])
-    if P is None or r >= p or s >= n:
-        return False
-    e = int_from_bytes(tagged_hash("BIP0340/challenge", sig[0:32] + pubkey + msg)) % n
-    R = point_add(point_mul(G, s), point_mul(P, n - e))
-    if R is None:
-        return False
-    return has_even_y(R) and (R[0] == r)
-
-
-def schnorr_sign(msg: bytes, seckey: bytes, aux_rand: bytes) -> bytes:
-    d0 = int_from_bytes(seckey)
-    if not (1 <= d0 <= n - 1):
-        raise ValueError("The secret key must be in the range 1..n-1.")
-    if len(aux_rand) != 32:
-        raise ValueError("aux_rand must be 32 bytes.")
-    P = point_mul(G, d0)
-    assert P is not None
-    d = d0 if has_even_y(P) else n - d0
-    t = xor_bytes(bytes_from_int(d), tagged_hash("BIP0340/aux", aux_rand))
-    k0 = int_from_bytes(tagged_hash("BIP0340/nonce", t + bytes_from_point(P) + msg)) % n
-    if k0 == 0:
-        raise RuntimeError("Failure. This happens only with negligible probability.")
-    R = point_mul(G, k0)
-    assert R is not None
-    k = k0 if has_even_y(R) else n - k0
-    e = int_from_bytes(tagged_hash("BIP0340/challenge", bytes_from_point(R) + bytes_from_point(P) + msg)) % n
-    sig = bytes_from_point(R) + bytes_from_int((k + e * d) % n)
-    if not schnorr_verify(msg, bytes_from_point(P), sig):
-        raise RuntimeError("The created signature does not pass verification.")
-    return sig
+# Use the vendored copy shared with BIP 374 instead of duplicating secp256k1
+# arithmetic and BIP 340 signing logic here.
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "bip-0374/secp256k1lab/src"))
+from secp256k1lab.bip340 import schnorr_sign
+from secp256k1lab.secp256k1 import G, Scalar
 
 
 def parse_hex(data: str, expected_len: int, field_name: str) -> bytes:
@@ -126,24 +23,28 @@ def parse_hex(data: str, expected_len: int, field_name: str) -> bytes:
     return raw
 
 
-def derive_signing_key(spend_seckey: bytes, tweak: bytes, output_pubkey: bytes) -> Tuple[int, int, bool]:
-    b_spend = int_from_bytes(spend_seckey)
-    if not (1 <= b_spend <= n - 1):
+def derive_signing_key(
+    spend_seckey: bytes, tweak: bytes, output_pubkey: bytes
+) -> tuple[Scalar, Scalar, bool]:
+    try:
+        b_spend = Scalar.from_bytes_checked(spend_seckey)
+    except ValueError as exc:
+        raise ValueError("spend key out of range") from exc
+    if b_spend == 0:
         raise ValueError("spend key out of range")
 
-    tweak_int = int_from_bytes(tweak)
-    d_raw = (b_spend + tweak_int) % n
+    d_raw = b_spend + Scalar.from_bytes_wrapping(tweak)
     if d_raw == 0:
         raise ValueError("tweaked private key is zero")
 
-    Q = point_mul(G, d_raw)
-    assert Q is not None
-    negated = not has_even_y(Q)
-    d = d_raw if not negated else n - d_raw
+    Q = d_raw * G
+    assert not Q.infinity
+    negated = not Q.has_even_y()
+    d = d_raw if not negated else -d_raw
 
-    Q_even = point_mul(G, d)
-    assert Q_even is not None
-    if bytes_from_point(Q_even) != output_pubkey:
+    Q_even = d * G
+    assert not Q_even.infinity
+    if Q_even.to_bytes_xonly() != output_pubkey:
         raise ValueError("tweaked key does not match output key")
 
     return d_raw, d, negated
@@ -169,12 +70,9 @@ def run_test_vectors(path: Path) -> bool:
             message = parse_hex(given["message"], 32, "message")
             aux_rand = parse_hex(given["aux_rand"], 32, "aux_rand")
 
-            d_raw, d, negated = derive_signing_key(spend_seckey, tweak, output_pubkey)
-            signature = schnorr_sign(message, bytes_from_int(d), aux_rand)
+            _, d, _ = derive_signing_key(spend_seckey, tweak, output_pubkey)
+            signature = schnorr_sign(message, d.to_bytes(), aux_rand)
 
-            assert bytes_from_int(d_raw).hex() == expected["raw_tweaked_seckey"]
-            assert negated == expected["negated"]
-            assert bytes_from_int(d).hex() == expected["final_seckey"]
             assert signature.hex() == expected["signature"]
         except Exception as exc:
             all_passed = False

bip-0376/test-vectors.json

@@ -10,9 +10,6 @@
         "aux_rand": "a617dfb275f834e26a6f0c94052dd88982c86297dba990fd96645026e7c69e10"
       },
       "expected": {
-        "raw_tweaked_seckey": "d341d791762f93fb9ba47ec1492040b7c67bd63ede8d7fadde90ca1c1e217a7b",
-        "negated": false,
-        "final_seckey": "d341d791762f93fb9ba47ec1492040b7c67bd63ede8d7fadde90ca1c1e217a7b",
         "signature": "d0c4f5ee3768c03a8d8e1204b8e52c6a4ded1f456d0f1707e7841928945c5a45bc1c0bc671d79612ef1c67a54bd50d653ce3d33c1fd966ce9a91e053f9417778"
       }
     },
@@ -26,9 +23,6 @@
         "aux_rand": "6b31977a8ac73ede3f3653ea0d96bc3656242461e31d771985a0b17084d3cf91"
       },
       "expected": {
-        "raw_tweaked_seckey": "7fa902ec0eabdbe69f8853746e9f5e664c94eef0e36a688d1499cab7f5d6e516",
-        "negated": true,
-        "final_seckey": "8056fd13f15424196077ac8b9160a1986e19edf5cbde37aeab3893d4da5f5c2b",
         "signature": "3df67213afd895a833bc046e9455c77a7e40165638ad489669a5c498d4d71ab565a9c54abda2e23e931f7a0f78a9f151bba07b8400b7b96d24f857c8ba65c022"
       }
     }