[WIP] rfc6979: integrate with crypto-bigint; KGenerator API

Implements functions which are a 1:1 mapping to the ones defined in
RFC6979, operating over `U: Unsigned + Encoding`.

Notably this also implements the modular reduction instead of leaving it
to the caller to perform. As the RFC notes, it's easily implemented as
conditional subtraction.

The public API has been changed to a `KGenerator` struct which provides
an iterator-like API that can be called repeatedly if needed, e.g. if
the computed `r` is zero.

This makes it possible to make the `ecdsa::hazmat` RFC6979-based
functions infallible, because they can automatically retry with the next
`k` until they find one that works.

Author: tarcieri

Cargo.lock

@@ -13,17 +13,16 @@
 //! </div>
 
 use crate::{EcdsaCurve, Error, Result};
-use core::cmp;
-use elliptic_curve::{FieldBytes, array::typenum::Unsigned};
+use elliptic_curve::FieldBytes;
 
 #[cfg(feature = "algorithm")]
 use {
     crate::{RecoveryId, Signature, SignatureSize},
     elliptic_curve::{
         CurveArithmetic, NonZeroScalar, ProjectivePoint, Scalar,
         array::ArraySize,
+        bigint::{BitOps, Encoding},
         ff::PrimeField,
-        field,
         group::{Curve as _, Group},
         ops::{Invert, MulByGeneratorVartime, Reduce},
         point::AffineCoordinates,
@@ -45,40 +44,6 @@ pub trait DigestAlgorithm: EcdsaCurve {
     type Digest: BlockSizeUser + Digest + FixedOutput + FixedOutputReset;
 }
 
-/// Partial implementation of the `bits2int` function as defined in
-/// [RFC6979 § 2.3.2] as well as [SEC1] § 2.3.8.
-///
-/// This is used to convert a message digest whose size may be smaller or
-/// larger than the size of the curve's scalar field into a serialized
-/// (unreduced) field element.
-///
-/// [RFC6979 § 2.3.2]: https://datatracker.ietf.org/doc/html/rfc6979#section-2.3.2
-/// [SEC1]: https://www.secg.org/sec1-v2.pdf
-pub fn bits2field<C: EcdsaCurve>(bits: &[u8]) -> Result<FieldBytes<C>> {
-    // Absolute 128-bit / 16-byte minimum to catch egregious digest misuse
-    // without rejecting legitimate combinations like SHA-256 with P-521
-    // (see e.g. XML Signature, which permits such pairings).
-    if bits.len() < 16 {
-        return Err(Error::new());
-    }
-
-    let mut field_bytes = FieldBytes::<C>::default();
-
-    match bits.len().cmp(&C::FieldBytesSize::USIZE) {
-        cmp::Ordering::Equal => field_bytes.copy_from_slice(bits),
-        cmp::Ordering::Less => {
-            // If bits is smaller than the field size, pad with zeroes on the left
-            field_bytes[(C::FieldBytesSize::USIZE - bits.len())..].copy_from_slice(bits);
-        }
-        cmp::Ordering::Greater => {
-            // If bits is larger than the field size, truncate
-            field_bytes.copy_from_slice(&bits[..C::FieldBytesSize::USIZE]);
-        }
-    }
-
-    Ok(field_bytes)
-}
-
 /// Sign a prehashed message digest using the provided secret scalar and
 /// ephemeral scalar, returning an ECDSA signature.
 ///
@@ -107,13 +72,13 @@ pub fn bits2field<C: EcdsaCurve>(bits: &[u8]) -> Result<FieldBytes<C>> {
 pub fn sign_prehashed<C>(
     d: &NonZeroScalar<C>,
     k: &NonZeroScalar<C>,
-    z: &FieldBytes<C>,
+    z: &[u8],
 ) -> Result<(Signature<C>, RecoveryId)>
 where
     C: EcdsaCurve + CurveArithmetic,
     SignatureSize<C>: ArraySize,
 {
-    let z = Scalar::<C>::reduce(z);
+    let z = bytes2scalar::<C>(z);
 
     // Compute scalar inversion of 𝑘.
     let k_inv = k.invert();
@@ -123,7 +88,7 @@ where
 
     // Lift x-coordinate of 𝑹 (element of base field) into a serialized big
     // integer, then reduce it into an element of the scalar field.
-    let r = Scalar::<C>::reduce(&R.x());
+    let r = bytes2scalar::<C>(&R.x());
 
     // Compute 𝒔 as a signature over 𝒓 and 𝒛.
     let s = *k_inv * (z + (r * d.as_ref()));
@@ -153,40 +118,31 @@ where
 /// - `z`: message digest to be signed, i.e. `H(m)`. Does not have to be reduced in advance.
 /// - `ad`: optional additional data, e.g. added entropy from an RNG
 ///
-/// # Errors
-///
-/// This will return an error if a zero-scalar was generated. It can be tried again with different
-/// entropy `ad`.
-///
 /// [RFC6979]: https://datatracker.ietf.org/doc/html/rfc6979
 #[cfg(feature = "algorithm")]
 pub fn sign_prehashed_rfc6979<C, D>(
     d: &NonZeroScalar<C>,
-    z: &FieldBytes<C>,
+    z: &[u8],
     ad: &[u8],
-) -> Result<(Signature<C>, RecoveryId)>
+) -> (Signature<C>, RecoveryId)
 where
     C: EcdsaCurve + CurveArithmetic,
     D: Digest + BlockSizeUser + FixedOutput + FixedOutputReset,
     SignatureSize<C>: ArraySize,
 {
-    // From RFC6979 § 2.4:
-    //
-    // H(m) is transformed into an integer modulo q using the bits2int
-    // transform and an extra modular reduction:
-    //
-    // h = bits2int(H(m)) mod q
-    let z2 = Scalar::<C>::reduce(z);
+    let order = C::ORDER;
+    let mut kgen = rfc6979::KGenerator::<D, C::Uint>::new(&d.to_repr(), z, ad, &order);
 
-    let k = NonZeroScalar::<C>::from_repr(rfc6979::generate_k::<D, _>(
-        &d.to_repr(),
-        &field::uint_to_bytes::<C>(&C::ORDER),
-        &z2.to_repr(),
-        ad,
-    ))
-    .unwrap();
+    loop {
+        let mut k_bytes = FieldBytes::<C>::default();
+        kgen.fill_next_k(&mut k_bytes);
 
-    sign_prehashed(d, &k, z)
+        if let Some(k) = NonZeroScalar::<C>::from_repr(k_bytes).into_option() {
+            if let Ok(ret) = sign_prehashed(d, &k, z) {
+                return ret;
+            }
+        }
+    }
 }
 
 /// Verify the prehashed message against the provided ECDSA signature.
@@ -198,11 +154,7 @@ where
 ///   ALGORITHM!!!
 /// - `sig`: signature to be verified against the key and message.
 #[cfg(feature = "algorithm")]
-pub fn verify_prehashed<C>(
-    q: &ProjectivePoint<C>,
-    z: &FieldBytes<C>,
-    sig: &Signature<C>,
-) -> Result<()>
+pub fn verify_prehashed<C>(q: &ProjectivePoint<C>, z: &[u8], sig: &Signature<C>) -> Result<()>
 where
     C: EcdsaCurve + CurveArithmetic,
     SignatureSize<C>: ArraySize,
@@ -211,7 +163,7 @@ where
         return Err(Error::new());
     }
 
-    let z = Scalar::<C>::reduce(z);
+    let z = bytes2scalar::<C>(z);
     let (r, s) = sig.split_scalars();
     let s_inv = *s.invert_vartime();
     let u1 = z * s_inv;
@@ -220,53 +172,24 @@ where
         .to_affine()
         .x();
 
-    if *r == Scalar::<C>::reduce(&x) {
+    if *r == bytes2scalar::<C>(&x) {
         Ok(())
     } else {
         Err(Error::new())
     }
 }
 
-#[cfg(all(test, feature = "dev"))]
-mod tests {
-    use super::bits2field;
-    use elliptic_curve::dev::MockCurve;
-    use hex_literal::hex;
-
-    #[test]
-    fn bits2field_too_small() {
-        assert!(bits2field::<MockCurve>(b"").is_err());
-        // 15 bytes is one short of the 128-bit absolute floor.
-        let prehash = hex!("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
-        assert!(bits2field::<MockCurve>(&prehash).is_err());
-    }
-
-    #[test]
-    fn bits2field_size_less() {
-        let prehash = hex!("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
-        let field_bytes = bits2field::<MockCurve>(&prehash).expect("field bytes");
-        assert_eq!(
-            field_bytes.as_slice(),
-            &hex!("00000000000000000000000000000000AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
-        );
-    }
-
-    #[test]
-    fn bits2field_size_eq() {
-        let prehash = hex!("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
-        let field_bytes = bits2field::<MockCurve>(&prehash).expect("field bytes");
-        assert_eq!(field_bytes.as_slice(), &prehash);
+/// Convert the provided bytestring into a `Scalar` for the given curve, interpreting it as big
+/// endian, zero-padding or truncating it to the bit length of `n` (curve order) if necessary,
+/// and then reducing it mod `n`.
+#[cfg(feature = "algorithm")]
+pub(crate) fn bytes2scalar<C: EcdsaCurve + CurveArithmetic>(mut bytes: &[u8]) -> Scalar<C> {
+    // Compute number of bytes in `n` (curve order)
+    let n_bits = C::ORDER.bits();
+    let n_bytes = n_bits.div_ceil(8) as usize;
+    if bytes.len() > n_bytes {
+        bytes = &bytes[..n_bytes];
     }
 
-    #[test]
-    fn bits2field_size_greater() {
-        let prehash = hex!(
-            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
-        );
-        let field_bytes = bits2field::<MockCurve>(&prehash).expect("field bytes");
-        assert_eq!(
-            field_bytes.as_slice(),
-            &hex!("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
-        );
-    }
+    <Scalar<C> as Reduce<C::Uint>>::reduce(&C::Uint::from_be_slice_truncated(bytes, n_bits))
 }

ecdsa/src/hazmat.rs

@@ -6,7 +6,7 @@ use crate::{Error, Result};
 use {
     crate::{
         EcdsaCurve, Signature, SignatureSize, SigningKey, VerifyingKey,
-        hazmat::{DigestAlgorithm, bits2field, sign_prehashed_rfc6979, verify_prehashed},
+        hazmat::{DigestAlgorithm, bytes2scalar, sign_prehashed_rfc6979, verify_prehashed},
     },
     digest::{Digest, FixedOutputReset, Update},
     elliptic_curve::{
@@ -16,7 +16,7 @@ use {
         bigint::CheckedAdd,
         field,
         ops::Invert,
-        ops::{LinearCombination, Reduce},
+        ops::LinearCombination,
         point::DecompressPoint,
         sec1::{self, FromSec1Point, ToSec1Point},
         subtle::CtOption,
@@ -135,7 +135,7 @@ impl RecoveryId {
         // Ensure signature verifies with the provided key
         verify_prehashed::<C>(
             &ProjectivePoint::<C>::from(*verifying_key.as_affine()),
-            &bits2field::<C>(prehash)?,
+            prehash,
             signature,
         )?;
 
@@ -181,24 +181,22 @@ where
         rng: &mut R,
         prehash: &[u8],
     ) -> Result<(Signature<C>, RecoveryId)> {
-        let z = bits2field::<C>(prehash)?;
-
-        loop {
-            let mut ad = FieldBytes::<C>::default();
-            rng.try_fill_bytes(&mut ad).map_err(|_| Error::new())?;
-
-            if let Ok(result) =
-                sign_prehashed_rfc6979::<C, C::Digest>(self.as_nonzero_scalar(), &z, &ad)
-            {
-                break Ok(result);
-            }
-        }
+        let mut ad = FieldBytes::<C>::default();
+        rng.try_fill_bytes(&mut ad).map_err(|_| Error::new())?;
+        Ok(sign_prehashed_rfc6979::<C, C::Digest>(
+            self.as_nonzero_scalar(),
+            prehash,
+            &ad,
+        ))
     }
 
     /// Sign the given message prehash, returning a signature and recovery ID.
     pub fn sign_prehash_recoverable(&self, prehash: &[u8]) -> Result<(Signature<C>, RecoveryId)> {
-        let z = bits2field::<C>(prehash)?;
-        sign_prehashed_rfc6979::<C, C::Digest>(self.as_nonzero_scalar(), &z, &[])
+        Ok(sign_prehashed_rfc6979::<C, C::Digest>(
+            self.as_nonzero_scalar(),
+            prehash,
+            b"",
+        ))
     }
 
     /// Sign the given message digest, returning a signature and recovery ID.
@@ -362,7 +360,7 @@ where
         recovery_id: RecoveryId,
     ) -> Result<Self> {
         let (r, s) = signature.split_scalars();
-        let z = Scalar::<C>::reduce(&bits2field::<C>(prehash)?);
+        let z = bytes2scalar::<C>(prehash);
 
         let r_bytes = if recovery_id.is_x_reduced() {
             let uint = field::bytes_to_uint::<C>(&r.to_repr())

ecdsa/src/recovery.rs

@@ -2,7 +2,7 @@
 
 use crate::{
     EcdsaCurve, Error, Result, Signature, SignatureSize, SignatureWithOid, ecdsa_oid_for_digest,
-    hazmat::{DigestAlgorithm, bits2field, sign_prehashed_rfc6979},
+    hazmat::{DigestAlgorithm, sign_prehashed_rfc6979},
 };
 use core::fmt::{self, Debug};
 use digest::{Digest, FixedOutput, const_oid::AssociatedOid};
@@ -157,8 +157,8 @@ where
     }
 }
 
-/// Sign message prehash using a deterministic ephemeral scalar (`k`)
-/// computed using the algorithm described in [RFC6979 § 3.2].
+/// Sign message prehash using a deterministic ephemeral scalar (`k`) computed using the algorithm
+/// described in [RFC6979 § 3.2].
 ///
 /// [RFC6979 § 3.2]: https://tools.ietf.org/html/rfc6979#section-3
 impl<C> PrehashSigner<Signature<C>> for SigningKey<C>
@@ -168,8 +168,7 @@ where
     SignatureSize<C>: ArraySize,
 {
     fn sign_prehash(&self, prehash: &[u8]) -> Result<Signature<C>> {
-        let z = bits2field::<C>(prehash)?;
-        Ok(sign_prehashed_rfc6979::<C, C::Digest>(&self.secret_scalar, &z, &[])?.0)
+        Ok(sign_prehashed_rfc6979::<C, C::Digest>(&self.secret_scalar, prehash, &[]).0)
     }
 }
 
@@ -231,18 +230,9 @@ where
         rng: &mut R,
         prehash: &[u8],
     ) -> Result<Signature<C>> {
-        let z = bits2field::<C>(prehash)?;
-
-        loop {
-            let mut ad = FieldBytes::<C>::default();
-            rng.try_fill_bytes(&mut ad).map_err(|_| Error::new())?;
-
-            if let Ok((signature, _)) =
-                sign_prehashed_rfc6979::<C, C::Digest>(&self.secret_scalar, &z, &ad)
-            {
-                break Ok(signature);
-            }
-        }
+        let mut ad = FieldBytes::<C>::default();
+        rng.try_fill_bytes(&mut ad).map_err(|_| Error::new())?;
+        Ok(sign_prehashed_rfc6979::<C, C::Digest>(&self.secret_scalar, prehash, &ad).0)
     }
 }
 

ecdsa/src/signing.rs

@@ -2,12 +2,12 @@
 
 use crate::{
     EcdsaCurve, Error, Result, Signature, SignatureSize,
-    hazmat::{self, DigestAlgorithm, bits2field},
+    hazmat::{self, DigestAlgorithm},
 };
 use core::{cmp::Ordering, fmt::Debug};
 use digest::{Digest, Update};
 use elliptic_curve::{
-    AffinePoint, CurveArithmetic, FieldBytesSize, ProjectivePoint, PublicKey,
+    AffinePoint, CurveArithmetic, FieldBytesSize, PublicKey,
     array::ArraySize,
     point::PointCompression,
     sec1::{self, CompressedPoint, FromSec1Point, Sec1Point, ToSec1Point},
@@ -163,11 +163,7 @@ where
     SignatureSize<C>: ArraySize,
 {
     fn verify_prehash(&self, prehash: &[u8], signature: &Signature<C>) -> Result<()> {
-        hazmat::verify_prehashed::<C>(
-            &ProjectivePoint::<C>::from(*self.inner.as_affine()),
-            &bits2field::<C>(prehash)?,
-            signature,
-        )
+        hazmat::verify_prehashed::<C>(&(*self.inner.as_affine()).into(), prehash, signature)
     }
 }