Verify a strictly DER-encoded ECDSA signature against this pubkey. See https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm for the ECDSA verifier algorithm
(self, sig, msg, low_s=True)
| 268 | return bytes([0x04]) + p[0].to_bytes(32, 'big') + p[1].to_bytes(32, 'big') |
| 269 | |
| 270 | def verify_ecdsa(self, sig, msg, low_s=True): |
| 271 | """Verify a strictly DER-encoded ECDSA signature against this pubkey. |
| 272 | |
| 273 | See https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm for the |
| 274 | ECDSA verifier algorithm""" |
| 275 | assert(self.valid) |
| 276 | |
| 277 | # Extract r and s from the DER formatted signature. Return false for |
| 278 | # any DER encoding errors. |
| 279 | if (sig[1] + 2 != len(sig)): |
| 280 | return False |
| 281 | if (len(sig) < 4): |
| 282 | return False |
| 283 | if (sig[0] != 0x30): |
| 284 | return False |
| 285 | if (sig[2] != 0x02): |
| 286 | return False |
| 287 | rlen = sig[3] |
| 288 | if (len(sig) < 6 + rlen): |
| 289 | return False |
| 290 | if rlen < 1 or rlen > 33: |
| 291 | return False |
| 292 | if sig[4] >= 0x80: |
| 293 | return False |
| 294 | if (rlen > 1 and (sig[4] == 0) and not (sig[5] & 0x80)): |
| 295 | return False |
| 296 | r = int.from_bytes(sig[4:4+rlen], 'big') |
| 297 | if (sig[4+rlen] != 0x02): |
| 298 | return False |
| 299 | slen = sig[5+rlen] |
| 300 | if slen < 1 or slen > 33: |
| 301 | return False |
| 302 | if (len(sig) != 6 + rlen + slen): |
| 303 | return False |
| 304 | if sig[6+rlen] >= 0x80: |
| 305 | return False |
| 306 | if (slen > 1 and (sig[6+rlen] == 0) and not (sig[7+rlen] & 0x80)): |
| 307 | return False |
| 308 | s = int.from_bytes(sig[6+rlen:6+rlen+slen], 'big') |
| 309 | |
| 310 | # Verify that r and s are within the group order |
| 311 | if r < 1 or s < 1 or r >= SECP256K1_ORDER or s >= SECP256K1_ORDER: |
| 312 | return False |
| 313 | if low_s and s >= SECP256K1_ORDER_HALF: |
| 314 | return False |
| 315 | z = int.from_bytes(msg, 'big') |
| 316 | |
| 317 | # Run verifier algorithm on r, s |
| 318 | w = modinv(s, SECP256K1_ORDER) |
| 319 | u1 = z*w % SECP256K1_ORDER |
| 320 | u2 = r*w % SECP256K1_ORDER |
| 321 | R = SECP256K1.affine(SECP256K1.mul([(SECP256K1_G, u1), (self.p, u2)])) |
| 322 | if R is None or (R[0] % SECP256K1_ORDER) != r: |
| 323 | return False |
| 324 | return True |
| 325 | |
| 326 | def generate_privkey(): |
| 327 | """Generate a valid random 32-byte private key.""" |