Bitcoin Core  21.99.0
P2P Digital Currency
valgrind_ctime_test.c
Go to the documentation of this file.
1 /***********************************************************************
2  * Copyright (c) 2020 Gregory Maxwell *
3  * Distributed under the MIT software license, see the accompanying *
4  * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5  ***********************************************************************/
6 
7 #include <valgrind/memcheck.h>
8 #include <stdio.h>
9 
10 #include "include/secp256k1.h"
11 #include "assumptions.h"
12 #include "util.h"
13 
14 #ifdef ENABLE_MODULE_ECDH
15 # include "include/secp256k1_ecdh.h"
16 #endif
17 
18 #ifdef ENABLE_MODULE_RECOVERY
20 #endif
21 
22 #ifdef ENABLE_MODULE_EXTRAKEYS
24 #endif
25 
26 #ifdef ENABLE_MODULE_SCHNORRSIG
28 #endif
29 
30 void run_tests(secp256k1_context *ctx, unsigned char *key);
31 
32 int main(void) {
34  unsigned char key[32];
35  int ret, i;
36 
37  if (!RUNNING_ON_VALGRIND) {
38  fprintf(stderr, "This test can only usefully be run inside valgrind.\n");
39  fprintf(stderr, "Usage: libtool --mode=execute valgrind ./valgrind_ctime_test\n");
40  return 1;
41  }
48  for (i = 0; i < 32; i++) {
49  key[i] = i + 65;
50  }
51 
52  run_tests(ctx, key);
53 
54  /* Test context randomisation. Do this last because it leaves the context
55  * tainted. */
56  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
57  ret = secp256k1_context_randomize(ctx, key);
58  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
59  CHECK(ret);
60 
62  return 0;
63 }
64 
65 void run_tests(secp256k1_context *ctx, unsigned char *key) {
66  secp256k1_ecdsa_signature signature;
67  secp256k1_pubkey pubkey;
68  size_t siglen = 74;
69  size_t outputlen = 33;
70  int i;
71  int ret;
72  unsigned char msg[32];
73  unsigned char sig[74];
74  unsigned char spubkey[33];
75 #ifdef ENABLE_MODULE_RECOVERY
76  secp256k1_ecdsa_recoverable_signature recoverable_signature;
77  int recid;
78 #endif
79 #ifdef ENABLE_MODULE_EXTRAKEYS
80  secp256k1_keypair keypair;
81 #endif
82 
83  for (i = 0; i < 32; i++) {
84  msg[i] = i + 1;
85  }
86 
87  /* Test keygen. */
88  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
89  ret = secp256k1_ec_pubkey_create(ctx, &pubkey, key);
90  VALGRIND_MAKE_MEM_DEFINED(&pubkey, sizeof(secp256k1_pubkey));
91  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
92  CHECK(ret);
93  CHECK(secp256k1_ec_pubkey_serialize(ctx, spubkey, &outputlen, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
94 
95  /* Test signing. */
96  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
97  ret = secp256k1_ecdsa_sign(ctx, &signature, msg, key, NULL, NULL);
98  VALGRIND_MAKE_MEM_DEFINED(&signature, sizeof(secp256k1_ecdsa_signature));
99  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
100  CHECK(ret);
101  CHECK(secp256k1_ecdsa_signature_serialize_der(ctx, sig, &siglen, &signature));
102 
103 #ifdef ENABLE_MODULE_ECDH
104  /* Test ECDH. */
105  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
106  ret = secp256k1_ecdh(ctx, msg, &pubkey, key, NULL, NULL);
107  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
108  CHECK(ret == 1);
109 #endif
110 
111 #ifdef ENABLE_MODULE_RECOVERY
112  /* Test signing a recoverable signature. */
113  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
114  ret = secp256k1_ecdsa_sign_recoverable(ctx, &recoverable_signature, msg, key, NULL, NULL);
115  VALGRIND_MAKE_MEM_DEFINED(&recoverable_signature, sizeof(recoverable_signature));
116  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
117  CHECK(ret);
118  CHECK(secp256k1_ecdsa_recoverable_signature_serialize_compact(ctx, sig, &recid, &recoverable_signature));
119  CHECK(recid >= 0 && recid <= 3);
120 #endif
121 
122  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
123  ret = secp256k1_ec_seckey_verify(ctx, key);
124  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
125  CHECK(ret == 1);
126 
127  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
128  ret = secp256k1_ec_seckey_negate(ctx, key);
129  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
130  CHECK(ret == 1);
131 
132  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
133  VALGRIND_MAKE_MEM_UNDEFINED(msg, 32);
134  ret = secp256k1_ec_seckey_tweak_add(ctx, key, msg);
135  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
136  CHECK(ret == 1);
137 
138  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
139  VALGRIND_MAKE_MEM_UNDEFINED(msg, 32);
140  ret = secp256k1_ec_seckey_tweak_mul(ctx, key, msg);
141  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
142  CHECK(ret == 1);
143 
144  /* Test keypair_create and keypair_xonly_tweak_add. */
145 #ifdef ENABLE_MODULE_EXTRAKEYS
146  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
147  ret = secp256k1_keypair_create(ctx, &keypair, key);
148  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
149  CHECK(ret == 1);
150 
151  /* The tweak is not treated as a secret in keypair_tweak_add */
152  VALGRIND_MAKE_MEM_DEFINED(msg, 32);
153  ret = secp256k1_keypair_xonly_tweak_add(ctx, &keypair, msg);
154  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
155  CHECK(ret == 1);
156 
157  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
158  VALGRIND_MAKE_MEM_UNDEFINED(&keypair, sizeof(keypair));
159  ret = secp256k1_keypair_sec(ctx, key, &keypair);
160  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
161  CHECK(ret == 1);
162 #endif
163 
164 #ifdef ENABLE_MODULE_SCHNORRSIG
165  VALGRIND_MAKE_MEM_UNDEFINED(key, 32);
166  ret = secp256k1_keypair_create(ctx, &keypair, key);
167  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
168  CHECK(ret == 1);
169  ret = secp256k1_schnorrsig_sign(ctx, sig, msg, &keypair, NULL, NULL);
170  VALGRIND_MAKE_MEM_DEFINED(&ret, sizeof(ret));
171  CHECK(ret == 1);
172 #endif
173 }
secp256k1_ecdsa_signature
Opaque data structured that holds a parsed ECDSA signature.
Definition: secp256k1.h:80
SECP256K1_CONTEXT_VERIFY
#define SECP256K1_CONTEXT_VERIFY
Flags to pass to secp256k1_context_create, secp256k1_context_preallocated_size, and secp256k1_context...
Definition: secp256k1.h:170
SECP256K1_CONTEXT_SIGN
#define SECP256K1_CONTEXT_SIGN
Definition: secp256k1.h:171
secp256k1_ecdsa_signature_serialize_der
SECP256K1_API int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize an ECDSA signature in DER format.
Definition: secp256k1.c:380
secp256k1_context_struct
Definition: secp256k1.c:69
secp256k1_ecdh.h
secp256k1_ec_seckey_negate
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_negate(const secp256k1_context *ctx, unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Negates a secret key in place.
Definition: secp256k1.c:590
secp256k1_ecdsa_sign_recoverable
SECP256K1_API int secp256k1_ecdsa_sign_recoverable(const secp256k1_context *ctx, secp256k1_ecdsa_recoverable_signature *sig, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create a recoverable ECDSA signature.
Definition: main_impl.h:123
secp256k1_recovery.h
secp256k1_keypair_sec
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_sec(const secp256k1_context *ctx, unsigned char *seckey, const secp256k1_keypair *keypair) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Get the secret key from a keypair.
Definition: main_impl.h:189
util.h
secp256k1_ecdsa_recoverable_signature
Opaque data structured that holds a parsed ECDSA signature, supporting pubkey recovery.
Definition: secp256k1_recovery.h:24
secp256k1_context_destroy
SECP256K1_API void secp256k1_context_destroy(secp256k1_context *ctx)
Destroy a secp256k1 context object (created in dynamically allocated memory).
Definition: secp256k1.c:196
secp256k1_context_create
SECP256K1_API secp256k1_context * secp256k1_context_create(unsigned int flags) SECP256K1_WARN_UNUSED_RESULT
Create a secp256k1 context object (in dynamically allocated memory).
Definition: secp256k1.c:152
secp256k1_keypair
Opaque data structure that holds a keypair consisting of a secret and a public key.
Definition: secp256k1_extrakeys.h:33
secp256k1_schnorrsig.h
SECP256K1_CONTEXT_DECLASSIFY
#define SECP256K1_CONTEXT_DECLASSIFY
Definition: secp256k1.h:172
secp256k1_ec_pubkey_serialize
SECP256K1_API int secp256k1_ec_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey *pubkey, unsigned int flags) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize a pubkey object into a serialized byte sequence.
Definition: secp256k1.c:296
secp256k1.h
secp256k1_keypair_create
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_create(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the keypair for a secret key.
Definition: main_impl.h:171
SECP256K1_EC_COMPRESSED
#define SECP256K1_EC_COMPRESSED
Flag to pass to secp256k1_ec_pubkey_serialize.
Definition: secp256k1.h:176
assumptions.h
run_tests
void run_tests(secp256k1_context *ctx, unsigned char *key)
Definition: valgrind_ctime_test.c:65
secp256k1_ecdsa_sign
SECP256K1_API int secp256k1_ecdsa_sign(const secp256k1_context *ctx, secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create an ECDSA signature.
Definition: secp256k1.c:535
main
int main(void)
Definition: valgrind_ctime_test.c:32
secp256k1_ec_seckey_verify
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify(const secp256k1_context *ctx, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Verify an ECDSA secret key.
Definition: secp256k1.c:549
secp256k1_ecdsa_recoverable_signature_serialize_compact
SECP256K1_API int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_context *ctx, unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize an ECDSA signature in compact format (64 bytes + recovery id).
Definition: main_impl.h:60
secp256k1_ec_seckey_tweak_add
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_tweak_add(const secp256k1_context *ctx, unsigned char *seckey, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a secret key by adding tweak to it.
Definition: secp256k1.c:636
secp256k1_ec_pubkey_create
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the public key for a secret key.
Definition: secp256k1.c:572
secp256k1_keypair_xonly_tweak_add
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_tweak_add(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a keypair by adding tweak32 to the secret key and updating the public key accordingly.
Definition: main_impl.h:230
secp256k1_ec_seckey_tweak_mul
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_tweak_mul(const secp256k1_context *ctx, unsigned char *seckey, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a secret key by multiplying it by a tweak.
Definition: secp256k1.c:681
secp256k1_ecdh
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdh(const secp256k1_context *ctx, unsigned char *output, const secp256k1_pubkey *pubkey, const unsigned char *seckey, secp256k1_ecdh_hash_function hashfp, void *data) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Compute an EC Diffie-Hellman secret in constant time.
Definition: main_impl.h:29
secp256k1_extrakeys.h
CHECK
#define CHECK(cond)
Definition: util.h:53
secp256k1_pubkey
Opaque data structure that holds a parsed and valid public key.
Definition: secp256k1.h:67
secp256k1_schnorrsig_sign
SECP256K1_API int secp256k1_schnorrsig_sign(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, secp256k1_nonce_function_hardened noncefp, void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create a Schnorr signature.
Definition: main_impl.h:127
ctx
static secp256k1_context * ctx
Definition: tests.c:42
secp256k1_context_randomize
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize(secp256k1_context *ctx, const unsigned char *seed32) SECP256K1_ARG_NONNULL(1)
Updates the context randomization to protect against side-channel leakage.
Definition: secp256k1.c:729