{"action":"created","comment":{"url":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/comments/294059490","pull_request_review_id":250206801,"id":294059490,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDI5NDA1OTQ5MA==","diff_hunk":"@@ -526,6 +526,37 @@ SECP256K1_API extern const secp256k1_nonce_function secp256k1_nonce_function_rfc\n /** A default safe nonce generation function (currently equal to secp256k1_nonce_function_rfc6979). */\n SECP256K1_API extern const secp256k1_nonce_function secp256k1_nonce_function_default;\n \n+/** Compute commitment on the client as part of the ECDSA Anti Nonce Sidechannel Protocol.\n+ *\n+ * ECDSA Anti Nonce Sidechannel Protocol:\n+ * 1. The host draws randomness `k2`, commits to it with sha256 and sends the commitment to the client.\n+ * 2. The client commits to it's original nonce `k1` using the host commitment by calling\n+ *    `secp256k1_ecdsa_anti_nonce_sidechan_client_commit`. The client sends the resulting commitment\n+ *   `R1` to the host.\n+ * 3. The host replies with `k2` generated in step 1.\n+ * 4. The client checks that the host commitment from step 1 commits to `k2` from step 3 and signs\n+ *    with `secp256k1_ecdsa_sign_nonce_tweak_add`, using the `k2` as the tweak and the host\n+ *    commitment as additional noncedata and sends the signature to the host.\n+ * 5. The host reconstructs the curve point `R` from the signature and verifies that `R = R1 + k2*G`.\n+ *\n+ *  Returns 1 on success, 0 on failure.\n+ *  Args:           ctx: pointer to a context object (cannot be NULL)\n+ *  Out:  client_commit: pointer to a pubkey where the clients public nonce will be\n+ *                       placed. (cannot be NULL)\n+ *  In:           msg32: the 32-byte message hash to be signed (cannot be NULL)\n+ *             seckey32: the 32-byte secret key used for signing (cannot be NULL)\n+ *              noncefp: pointer to a nonce generation function. If NULL, secp256k1_nonce_function_default is used\n+ *    rand_commitment32: the 32-byte randomness commitment from the host (cannot be NULL)\n+ */\n+SECP256K1_API int secp256k1_ecdsa_anti_nonce_sidechan_client_commit(\n+    const secp256k1_context* ctx,\n+    secp256k1_pubkey *client_commit,\n+    const unsigned char *msg32,\n+    const unsigned char *seckey32,\n+    secp256k1_nonce_function noncefp,","path":"include/secp256k1.h","position":31,"original_position":31,"commit_id":"ba34c6efd30cd238b11377322570b08e830a0a4a","original_commit_id":"ba34c6efd30cd238b11377322570b08e830a0a4a","user":{"login":"benma","id":1225267,"node_id":"MDQ6VXNlcjEyMjUyNjc=","avatar_url":"https://avatars0.githubusercontent.com/u/1225267?v=4","gravatar_id":"","url":"https://api.github.com/users/benma","html_url":"https://github.com/benma","followers_url":"https://api.github.com/users/benma/followers","following_url":"https://api.github.com/users/benma/following{/other_user}","gists_url":"https://api.github.com/users/benma/gists{/gist_id}","starred_url":"https://api.github.com/users/benma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benma/subscriptions","organizations_url":"https://api.github.com/users/benma/orgs","repos_url":"https://api.github.com/users/benma/repos","events_url":"https://api.github.com/users/benma/events{/privacy}","received_events_url":"https://api.github.com/users/benma/received_events","type":"User","site_admin":false},"body":"fixed","created_at":"2019-06-15T21:04:20Z","updated_at":"2019-06-15T21:04:20Z","html_url":"https://github.com/bitcoin-core/secp256k1/pull/637#discussion_r294059490","pull_request_url":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/comments/294059490"},"html":{"href":"https://github.com/bitcoin-core/secp256k1/pull/637#discussion_r294059490"},"pull_request":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637"}},"in_reply_to_id":292658968},"pull_request":{"url":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637","id":287045803,"node_id":"MDExOlB1bGxSZXF1ZXN0Mjg3MDQ1ODAz","html_url":"https://github.com/bitcoin-core/secp256k1/pull/637","diff_url":"https://github.com/bitcoin-core/secp256k1/pull/637.diff","patch_url":"https://github.com/bitcoin-core/secp256k1/pull/637.patch","issue_url":"https://api.github.com/repos/bitcoin-core/secp256k1/issues/637","number":637,"state":"open","locked":false,"title":"[experiment/wip] ecdsa nonce anti sidechan util functions","user":{"login":"benma","id":1225267,"node_id":"MDQ6VXNlcjEyMjUyNjc=","avatar_url":"https://avatars0.githubusercontent.com/u/1225267?v=4","gravatar_id":"","url":"https://api.github.com/users/benma","html_url":"https://github.com/benma","followers_url":"https://api.github.com/users/benma/followers","following_url":"https://api.github.com/users/benma/following{/other_user}","gists_url":"https://api.github.com/users/benma/gists{/gist_id}","starred_url":"https://api.github.com/users/benma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benma/subscriptions","organizations_url":"https://api.github.com/users/benma/orgs","repos_url":"https://api.github.com/users/benma/repos","events_url":"https://api.github.com/users/benma/events{/privacy}","received_events_url":"https://api.github.com/users/benma/received_events","type":"User","site_admin":false},"body":"This is based on the description of the fix by Stepan: https://medium.com/cryptoadvance/hardware-wallets-can-be-hacked-but-this-is-fine-a6156bbd199\r\n\r\n\r\nThe protocol wording and functions are copied/adapted from Jonas\r\nNick's PRs which do the same for BIP-Schnorr:\r\n\r\nhttps://github.com/bitcoin-core/secp256k1/pull/590\r\n\r\nhttps://github.com/bitcoin-core/secp256k1/pull/590/commits/ae5fb7f8f143244de07e17fee6671e0dd68c81a6#diff-b19c5ee427283d4d82bc5beb4e2f4777R59\r\n\r\nhttps://github.com/bitcoin-core/secp256k1/pull/590/commits/ae5fb7f8f143244de07e17fee6671e0dd68c81a6#diff-313ca26f0048bc16a608709915d0111eR70\r\n\r\n1.\r\nAdd secp256k1_ecdsa_anti_nonce_sidechan_client_commit to return the\r\ncurve point committing to the signing client nonce.\r\n\r\nThis is a convenience function and can technically be emulated by\r\ncalling secp256k1_ecdsa_sign() and reconstructing the curve point from\r\nthe signature r/s values.\r\n\r\n2.\r\n\r\nsecp256k1_ecdsa_sign_nonce_tweak_add, which is the same as\r\nsecp256k1_ecdsa_sign_nonce, but with an additional optional tweak parameter to\r\nadd to the nonce.\r\n\r\nThe nicer way to do this is to redefine `secp256k1_nonce_function` to\r\nhave a tweak param, but this would break API compatiblity. The way it\r\nis implemented is fully backwards compatible.","created_at":"2019-06-11T11:33:00Z","updated_at":"2019-06-15T21:04:20Z","closed_at":null,"merged_at":null,"merge_commit_sha":"20a949ef9e303557e1043e21bc790afbd7a97457","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637/commits","review_comments_url":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637/comments","review_comment_url":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/comments{/number}","comments_url":"https://api.github.com/repos/bitcoin-core/secp256k1/issues/637/comments","statuses_url":"https://api.github.com/repos/bitcoin-core/secp256k1/statuses/ba34c6efd30cd238b11377322570b08e830a0a4a","head":{"label":"benma:ecdsa_nonce_sidechan","ref":"ecdsa_nonce_sidechan","sha":"ba34c6efd30cd238b11377322570b08e830a0a4a","user":{"login":"benma","id":1225267,"node_id":"MDQ6VXNlcjEyMjUyNjc=","avatar_url":"https://avatars0.githubusercontent.com/u/1225267?v=4","gravatar_id":"","url":"https://api.github.com/users/benma","html_url":"https://github.com/benma","followers_url":"https://api.github.com/users/benma/followers","following_url":"https://api.github.com/users/benma/following{/other_user}","gists_url":"https://api.github.com/users/benma/gists{/gist_id}","starred_url":"https://api.github.com/users/benma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benma/subscriptions","organizations_url":"https://api.github.com/users/benma/orgs","repos_url":"https://api.github.com/users/benma/repos","events_url":"https://api.github.com/users/benma/events{/privacy}","received_events_url":"https://api.github.com/users/benma/received_events","type":"User","site_admin":false},"repo":{"id":191352053,"node_id":"MDEwOlJlcG9zaXRvcnkxOTEzNTIwNTM=","name":"secp256k1","full_name":"benma/secp256k1","private":false,"owner":{"login":"benma","id":1225267,"node_id":"MDQ6VXNlcjEyMjUyNjc=","avatar_url":"https://avatars0.githubusercontent.com/u/1225267?v=4","gravatar_id":"","url":"https://api.github.com/users/benma","html_url":"https://github.com/benma","followers_url":"https://api.github.com/users/benma/followers","following_url":"https://api.github.com/users/benma/following{/other_user}","gists_url":"https://api.github.com/users/benma/gists{/gist_id}","starred_url":"https://api.github.com/users/benma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benma/subscriptions","organizations_url":"https://api.github.com/users/benma/orgs","repos_url":"https://api.github.com/users/benma/repos","events_url":"https://api.github.com/users/benma/events{/privacy}","received_events_url":"https://api.github.com/users/benma/received_events","type":"User","site_admin":false},"html_url":"https://github.com/benma/secp256k1","description":"Optimized C library for EC operations on curve secp256k1","fork":true,"url":"https://api.github.com/repos/benma/secp256k1","forks_url":"https://api.github.com/repos/benma/secp256k1/forks","keys_url":"https://api.github.com/repos/benma/secp256k1/keys{/key_id}","collaborators_url":"https://api.github.com/repos/benma/secp256k1/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/benma/secp256k1/teams","hooks_url":"https://api.github.com/repos/benma/secp256k1/hooks","issue_events_url":"https://api.github.com/repos/benma/secp256k1/issues/events{/number}","events_url":"https://api.github.com/repos/benma/secp256k1/events","assignees_url":"https://api.github.com/repos/benma/secp256k1/assignees{/user}","branches_url":"https://api.github.com/repos/benma/secp256k1/branches{/branch}","tags_url":"https://api.github.com/repos/benma/secp256k1/tags","blobs_url":"https://api.github.com/repos/benma/secp256k1/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/benma/secp256k1/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/benma/secp256k1/git/refs{/sha}","trees_url":"https://api.github.com/repos/benma/secp256k1/git/trees{/sha}","statuses_url":"https://api.github.com/repos/benma/secp256k1/statuses/{sha}","languages_url":"https://api.github.com/repos/benma/secp256k1/languages","stargazers_url":"https://api.github.com/repos/benma/secp256k1/stargazers","contributors_url":"https://api.github.com/repos/benma/secp256k1/contributors","subscribers_url":"https://api.github.com/repos/benma/secp256k1/subscribers","subscription_url":"https://api.github.com/repos/benma/secp256k1/subscription","commits_url":"https://api.github.com/repos/benma/secp256k1/commits{/sha}","git_commits_url":"https://api.github.com/repos/benma/secp256k1/git/commits{/sha}","comments_url":"https://api.github.com/repos/benma/secp256k1/comments{/number}","issue_comment_url":"https://api.github.com/repos/benma/secp256k1/issues/comments{/number}","contents_url":"https://api.github.com/repos/benma/secp256k1/contents/{+path}","compare_url":"https://api.github.com/repos/benma/secp256k1/compare/{base}...{head}","merges_url":"https://api.github.com/repos/benma/secp256k1/merges","archive_url":"https://api.github.com/repos/benma/secp256k1/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/benma/secp256k1/downloads","issues_url":"https://api.github.com/repos/benma/secp256k1/issues{/number}","pulls_url":"https://api.github.com/repos/benma/secp256k1/pulls{/number}","milestones_url":"https://api.github.com/repos/benma/secp256k1/milestones{/number}","notifications_url":"https://api.github.com/repos/benma/secp256k1/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/benma/secp256k1/labels{/name}","releases_url":"https://api.github.com/repos/benma/secp256k1/releases{/id}","deployments_url":"https://api.github.com/repos/benma/secp256k1/deployments","created_at":"2019-06-11T10:50:34Z","updated_at":"2019-06-11T10:50:37Z","pushed_at":"2019-06-11T12:53:59Z","git_url":"git://github.com/benma/secp256k1.git","ssh_url":"git@github.com:benma/secp256k1.git","clone_url":"https://github.com/benma/secp256k1.git","svn_url":"https://github.com/benma/secp256k1","homepage":null,"size":1984,"stargazers_count":0,"watchers_count":0,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":0,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"bitcoin-core:master","ref":"master","sha":"fa3301713549d118e57ebe6551d062903ddd6b63","user":{"login":"bitcoin-core","id":13464320,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEzNDY0MzIw","avatar_url":"https://avatars2.githubusercontent.com/u/13464320?v=4","gravatar_id":"","url":"https://api.github.com/users/bitcoin-core","html_url":"https://github.com/bitcoin-core","followers_url":"https://api.github.com/users/bitcoin-core/followers","following_url":"https://api.github.com/users/bitcoin-core/following{/other_user}","gists_url":"https://api.github.com/users/bitcoin-core/gists{/gist_id}","starred_url":"https://api.github.com/users/bitcoin-core/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bitcoin-core/subscriptions","organizations_url":"https://api.github.com/users/bitcoin-core/orgs","repos_url":"https://api.github.com/users/bitcoin-core/repos","events_url":"https://api.github.com/users/bitcoin-core/events{/privacy}","received_events_url":"https://api.github.com/users/bitcoin-core/received_events","type":"Organization","site_admin":false},"repo":{"id":16648618,"node_id":"MDEwOlJlcG9zaXRvcnkxNjY0ODYxOA==","name":"secp256k1","full_name":"bitcoin-core/secp256k1","private":false,"owner":{"login":"bitcoin-core","id":13464320,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEzNDY0MzIw","avatar_url":"https://avatars2.githubusercontent.com/u/13464320?v=4","gravatar_id":"","url":"https://api.github.com/users/bitcoin-core","html_url":"https://github.com/bitcoin-core","followers_url":"https://api.github.com/users/bitcoin-core/followers","following_url":"https://api.github.com/users/bitcoin-core/following{/other_user}","gists_url":"https://api.github.com/users/bitcoin-core/gists{/gist_id}","starred_url":"https://api.github.com/users/bitcoin-core/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bitcoin-core/subscriptions","organizations_url":"https://api.github.com/users/bitcoin-core/orgs","repos_url":"https://api.github.com/users/bitcoin-core/repos","events_url":"https://api.github.com/users/bitcoin-core/events{/privacy}","received_events_url":"https://api.github.com/users/bitcoin-core/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/bitcoin-core/secp256k1","description":"Optimized C library for EC operations on curve secp256k1","fork":false,"url":"https://api.github.com/repos/bitcoin-core/secp256k1","forks_url":"https://api.github.com/repos/bitcoin-core/secp256k1/forks","keys_url":"https://api.github.com/repos/bitcoin-core/secp256k1/keys{/key_id}","collaborators_url":"https://api.github.com/repos/bitcoin-core/secp256k1/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/bitcoin-core/secp256k1/teams","hooks_url":"https://api.github.com/repos/bitcoin-core/secp256k1/hooks","issue_events_url":"https://api.github.com/repos/bitcoin-core/secp256k1/issues/events{/number}","events_url":"https://api.github.com/repos/bitcoin-core/secp256k1/events","assignees_url":"https://api.github.com/repos/bitcoin-core/secp256k1/assignees{/user}","branches_url":"https://api.github.com/repos/bitcoin-core/secp256k1/branches{/branch}","tags_url":"https://api.github.com/repos/bitcoin-core/secp256k1/tags","blobs_url":"https://api.github.com/repos/bitcoin-core/secp256k1/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/bitcoin-core/secp256k1/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/bitcoin-core/secp256k1/git/refs{/sha}","trees_url":"https://api.github.com/repos/bitcoin-core/secp256k1/git/trees{/sha}","statuses_url":"https://api.github.com/repos/bitcoin-core/secp256k1/statuses/{sha}","languages_url":"https://api.github.com/repos/bitcoin-core/secp256k1/languages","stargazers_url":"https://api.github.com/repos/bitcoin-core/secp256k1/stargazers","contributors_url":"https://api.github.com/repos/bitcoin-core/secp256k1/contributors","subscribers_url":"https://api.github.com/repos/bitcoin-core/secp256k1/subscribers","subscription_url":"https://api.github.com/repos/bitcoin-core/secp256k1/subscription","commits_url":"https://api.github.com/repos/bitcoin-core/secp256k1/commits{/sha}","git_commits_url":"https://api.github.com/repos/bitcoin-core/secp256k1/git/commits{/sha}","comments_url":"https://api.github.com/repos/bitcoin-core/secp256k1/comments{/number}","issue_comment_url":"https://api.github.com/repos/bitcoin-core/secp256k1/issues/comments{/number}","contents_url":"https://api.github.com/repos/bitcoin-core/secp256k1/contents/{+path}","compare_url":"https://api.github.com/repos/bitcoin-core/secp256k1/compare/{base}...{head}","merges_url":"https://api.github.com/repos/bitcoin-core/secp256k1/merges","archive_url":"https://api.github.com/repos/bitcoin-core/secp256k1/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/bitcoin-core/secp256k1/downloads","issues_url":"https://api.github.com/repos/bitcoin-core/secp256k1/issues{/number}","pulls_url":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls{/number}","milestones_url":"https://api.github.com/repos/bitcoin-core/secp256k1/milestones{/number}","notifications_url":"https://api.github.com/repos/bitcoin-core/secp256k1/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/bitcoin-core/secp256k1/labels{/name}","releases_url":"https://api.github.com/repos/bitcoin-core/secp256k1/releases{/id}","deployments_url":"https://api.github.com/repos/bitcoin-core/secp256k1/deployments","created_at":"2014-02-08T17:30:06Z","updated_at":"2019-06-14T12:00:37Z","pushed_at":"2019-06-13T14:52:00Z","git_url":"git://github.com/bitcoin-core/secp256k1.git","ssh_url":"git@github.com:bitcoin-core/secp256k1.git","clone_url":"https://github.com/bitcoin-core/secp256k1.git","svn_url":"https://github.com/bitcoin-core/secp256k1","homepage":null,"size":2040,"stargazers_count":814,"watchers_count":814,"language":"C","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":492,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":68,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":492,"open_issues":68,"watchers":814,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637"},"html":{"href":"https://github.com/bitcoin-core/secp256k1/pull/637"},"issue":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/issues/637"},"comments":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/issues/637/comments"},"review_comments":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637/comments"},"review_comment":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/pulls/637/commits"},"statuses":{"href":"https://api.github.com/repos/bitcoin-core/secp256k1/statuses/ba34c6efd30cd238b11377322570b08e830a0a4a"}},"author_association":"NONE"}}
{"actor":{"display_login":"benma"}}