{"action":"closed","issue":{"url":"https://api.github.com/repos/warner/python-ecdsa/issues/36","repository_url":"https://api.github.com/repos/warner/python-ecdsa","labels_url":"https://api.github.com/repos/warner/python-ecdsa/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/warner/python-ecdsa/issues/36/comments","events_url":"https://api.github.com/repos/warner/python-ecdsa/issues/36/events","html_url":"https://github.com/warner/python-ecdsa/issues/36","id":53291643,"node_id":"MDU6SXNzdWU1MzI5MTY0Mw==","number":36,"title":"RFC6979 proper handling of bad r or s.","user":{"login":"dabura667","id":6586275,"node_id":"MDQ6VXNlcjY1ODYyNzU=","avatar_url":"https://avatars2.githubusercontent.com/u/6586275?v=4","gravatar_id":"","url":"https://api.github.com/users/dabura667","html_url":"https://github.com/dabura667","followers_url":"https://api.github.com/users/dabura667/followers","following_url":"https://api.github.com/users/dabura667/following{/other_user}","gists_url":"https://api.github.com/users/dabura667/gists{/gist_id}","starred_url":"https://api.github.com/users/dabura667/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dabura667/subscriptions","organizations_url":"https://api.github.com/users/dabura667/orgs","repos_url":"https://api.github.com/users/dabura667/repos","events_url":"https://api.github.com/users/dabura667/events{/privacy}","received_events_url":"https://api.github.com/users/dabura667/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/warner/python-ecdsa/milestones/1","html_url":"https://github.com/warner/python-ecdsa/milestone/1","labels_url":"https://api.github.com/repos/warner/python-ecdsa/milestones/1/labels","id":3623873,"node_id":"MDk6TWlsZXN0b25lMzYyMzg3Mw==","number":1,"title":"v0.14","description":"The next planned release. No specific date, but \"some time in 2018\" is expected.","creator":{"login":"tomato42","id":618246,"node_id":"MDQ6VXNlcjYxODI0Ng==","avatar_url":"https://avatars1.githubusercontent.com/u/618246?v=4","gravatar_id":"","url":"https://api.github.com/users/tomato42","html_url":"https://github.com/tomato42","followers_url":"https://api.github.com/users/tomato42/followers","following_url":"https://api.github.com/users/tomato42/following{/other_user}","gists_url":"https://api.github.com/users/tomato42/gists{/gist_id}","starred_url":"https://api.github.com/users/tomato42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomato42/subscriptions","organizations_url":"https://api.github.com/users/tomato42/orgs","repos_url":"https://api.github.com/users/tomato42/repos","events_url":"https://api.github.com/users/tomato42/events{/privacy}","received_events_url":"https://api.github.com/users/tomato42/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":6,"state":"open","created_at":"2018-09-05T09:34:24Z","updated_at":"2018-09-12T13:02:54Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-01-03T02:37:22Z","updated_at":"2018-09-12T13:02:54Z","closed_at":"2018-09-12T13:02:53Z","author_association":"NONE","body":"https://github.com/warner/python-ecdsa/blob/master/ecdsa/ecdsa.py#L147\n\nCurrently deterministic signing will bring the code to this point and fail in the (EXTREMELY) unlikely event of r == 0 or s == 0.\n\nHowever, RFC 6979 states that:\n\n> If that value of k is within the [1,q-1] range, and **is\n> suitable for DSA or ECDSA (i.e., it results in an r value\n> that is not 0**; see Section 3.4), then the generation of k is\n> finished. The obtained value of k is used in DSA or ECDSA.\n> **Otherwise, compute**:\n\nSo if the user is using `keys.SigningKey.sign_deterministic()` and `ecdsa.Private_key.sign()` returns an invalid r or s, the Step H loop should repeat once more.\n\nBitcore, for example, uses an int called badrs in the signing function\nhttps://github.com/bitpay/bitcore/blob/master/lib/crypto/ecdsa.js#L204\n\nIn the event that r or s is 0, badrs is incremented, and they pass that int to the RFC6979 function to force a loop here:\nhttps://github.com/bitpay/bitcore/blob/master/lib/crypto/ecdsa.js#L100\n\nThis is for efficiency, as adding a r and s value check would add an extra calculation of r and s.\n\nHowever, I think it would be trivial to just add a function checking the r and s value in the current check here, and I don't think it is that much of a computational waste.\nhttps://github.com/warner/python-ecdsa/blob/master/ecdsa/rfc6979.py#L99\n\nSeeing as the `ecdsa.Private_key.sign()` does not necessarily use `keys.SigningKey.sign_deterministic()` it would be better to avoid a method like the `badrs` and create a new function for use in line 99 in rfc6979.py to check if r or s will be 0.\n\nMaybe instead of only passing the curve order to generate_k(), you could pass the entire curve object, and pass along that object to the r and s check function. (which will undoubtedly need the generator, order, etc...)\n\nIt's a bit nit-picky, but still. It's written in the RFC.\n\nThanks in advanced for your thoughts.\n\nI refrained from a pull request, as I first wanted to ask how you would plan to attack this problem.\n"}}
{"actor":{"display_login":"tomato42"}}