fix: secp256k1 coordinate validation and libsecp256k1 update#66
Merged
fix: secp256k1 coordinate validation and libsecp256k1 update#66
Conversation
Updates the libsecp256k1 dependency to commit: c0d9480fbbf8eccbd4be23ed27f6f2af6f3b211e PR: ``` BenchmarkSign-24 57756 21214 ns/op 164 B/op 3 allocs/op BenchmarkRecover-24 37156 33044 ns/op 80 B/op 1 allocs/op BenchmarkEcrecoverSignature-24 36889 32935 ns/op 80 B/op 1 allocs/op BenchmarkVerifySignature-24 41163 29207 ns/op 0 B/op 0 allocs/op BenchmarkDecompressPubkey-24 318624 4062 ns/op 304 B/op 6 allocs/op ``` Master: ``` BenchmarkSign-24 34509 35330 ns/op 164 B/op 3 allocs/op BenchmarkRecover-24 25418 47725 ns/op 80 B/op 1 allocs/op BenchmarkEcrecoverSignature-24 25735 47591 ns/op 80 B/op 1 allocs/op BenchmarkVerifySignature-24 29108 41097 ns/op 0 B/op 0 allocs/op BenchmarkDecompressPubkey-24 294747 4143 ns/op 304 B/op 6 allocs/op ``` Performance seems to be improved significantly: ``` Sign-24 34.86µ ± 3% 21.66µ ± 2% -37.86% (p=0.000 n=10) Recover-24 46.14µ ± 3% 33.24µ ± 2% -27.95% (p=0.000 n=10) ```
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR hardens the secp256k1 elliptic curve implementation against invalid public key inputs. The core fix adds coordinate range checks before curve operations — points with coordinates ≥ P (the field prime) are now rejected as invalid, preventing potential undefined behavior in the underlying C library.
To apply this fix cleanly, the upstream
libsecp256k1C library was updated to a newer version and related refactoring commits were ported.Upstream References
Security Fixes
1. Coordinate range check in
IsOnCurve(curve.go)Points with
x ≥ Pory ≥ Pare now rejected before the curve equation is evaluated. Previously, such coordinates would wrap around modulo P and could produce a false positive.2. Field element validation in scalar multiplication (
ext.h)secp256k1_fe_set_b32_limit()return value is now checked. If the input point coordinates exceed the field prime, the operation returns early with an error instead of proceeding with invalid values.3.
IsOnCurveoverride inbtCurve(signature_nocgo.go)The pure-Go fallback path (
btCurve) also gains an explicit coordinate range check, ensuring the no-cgo build has the same validation as the cgo path.4.
UnmarshalPubkeycurve validation (crypto.go)S256().IsOnCurve(x, y)is now called after parsing the public key bytes, so any key with coordinates not on the curve is rejected at deserialization time.Other Changes
libsecp256k1C library to a newer upstream version.math.ReadBitsfromcommon/mathused instead of manual bit extraction.