search

mimblewimble / secp256k1-zkp

Fork of secp256k1-zkp for the Grin/MimbleWimble project
MIT License
32 stars 42 forks source link

Fix secp256k1_scalar_chacha20 in big endian mode. #55

Open tecnovert opened 3 years ago

antiochp commented 3 years ago

Hi @tecnovert thanks for the PR! Can you give some context on what's going on here?

tecnovert commented 3 years ago

The modified code is reversing the scalar (bignum) results. secp256k1 scalars are big endian and the chacha20 code output is little endian. They always need reversing regardless of the endianness of the underlying system, but on big endian systems BE32 is defined as a NOP. The fix is to use a new always defined SW32 macro.

The changes to configure.ac set WORDS_BIGENDIAN which wasn't defined anywhere. The changes to .travis.yml add an extra test case on a big endian system (s390x).

Here is the log of a travis run with debugging messages without the fix (expand "$ cat ./tests.log"): https://travis-ci.org/github/tecnovert/secp256k1/jobs/738789811

Notice result vs expected:

r1 ade0b876 903df1a0 e56a5d40 28bd8653b819d2bd1aed8da0ccef36a8c70d778b
e1 76b8e0ad a0f13d90 405d6ae5 5386bd28bdd219b8a08ded1aa836efcc8b770dc7

And after: https://travis-ci.org/github/tecnovert/secp256k1/jobs/738794486