toDERHex incompatible with other libs

[filefilegoadmin]

Hi,

I am trying to use this module in the browser, and we have a backend which runs golang with "go-libp2p/core/crypto/key.go" using secp256k1.

The problem is when I sign a message using noble-curves and export the sig using toDERHex, in libp2p (they are using DER) the verification fails without error.

Same private key is used btw

[filefilegoadmin]

This is where the sig is serialized: https://github.com/libp2p/go-libp2p/blob/master/core/crypto/secp256k1.go#L81

[paulmillr]

What makes you think it's noble who is wrong and NOT go-libp2p? We are fuzzed extensively and test against wycheproof DER.

[paulmillr]

Here's actual source code of their verify function for the record:

https://github.com/decred/dcrd/blob/b4fab9efd838469f718fc943f2f19828d7829b49/dcrec/secp256k1/ecdsa/signature.go#L163

[filefilegoadmin]

The serialization of the sig happens here: https://github.com/decred/dcrd/blob/master/dcrec/secp256k1/ecdsa/signature.go#L69 Its difficult to see which one is wrong, but i will open an issue there as well

[paulmillr]

I suggest executing ParseDERSignature from their library on your noble signature and seeing which error it throws.

[jrick]

libp2p is implicitly using sha256 https://github.com/libp2p/go-libp2p/blob/master/core/crypto/ecdsa.go#L136

[paulmillr]

use prehash: true