update btcec to v2 and use the latest btcutil #9250

wcsiu · 2022-08-14T11:24:01Z

PR checklist

Tests written/updated, or no tests needed
CHANGELOG_PENDING.md updated, or no changelog entry needed
Updated relevant documentation (docs/) and code comments, or no
documentation updates needed

cmwaters · 2022-08-16T09:54:35Z

We have recently changed the default branch to main. Could you rebase your changes of that branch?

Is v2 backwards compatible. i.e. will v2 secp256k1 still verify old signatures?

wcsiu · 2022-08-19T17:07:29Z

We have recently changed the default branch to main. Could you rebase your changes of that branch?

Is v2 backwards compatible. i.e. will v2 secp256k1 still verify old signatures?

I have checked the test cases from both the older and newer versions. The are the same.
https://github.com/btcsuite/btcd/blob/btcec/v2.2.1/btcec/ecdsa/signature_test.go#L40
https://github.com/btcsuite/btcd/blob/v0.22.1/btcec/signature_test.go#L38

I have also updated the tests in tendermint to make sure the signature verification tests pass.

Hence, the new version should still be able to verify old secp256k1 signatures.

Of course, as always, more tests on it will be better.

I will finish the rebase as soon as possible, but it is not trivial. In the worst case, I will submit a new PR.

wcsiu · 2022-08-22T14:49:18Z

@cmwaters I have rebased my branch to main branch. Please have a look.

odeke-em · 2022-08-25T04:12:09Z

Kindly cc-ing @veorq and @elias-orijtech to help with a security review.

elias-orijtech

LGTM other than a suggestion about splitting the change in two; leaving for @veorq.

elias-orijtech · 2022-08-25T09:54:23Z

crypto/secp256k1/secp256k1.go


-	sig, err := priv.Sign(crypto.Sha256(msg))
+	sig, err := ecdsa.SignCompact(priv, crypto.Sha256(msg), false)


I suggest using https://pkg.go.dev/github.com/btcsuite/btcd/btcec/v2/ecdsa#Sign to gain a smaller diff. Then, a follow-up commit (maybe same PR) can replace Sign with SignCompact and delete serializeSig

Just found that they no longer expose R and S as exported fields anymore(https://github.com/decred/dcrd/blob/dcrec/secp256k1/v4.1.0/dcrec/secp256k1/ecdsa/signature.go#L52) so logic in serializeSig will no longer work.

Do you think we still need to break it into two commits?

I see, thanks. In that case, using SignCompact is probably ok.

thanethomson

Apart from the minor changelog nit, I'd recommend considering the change mentioned by @elias-orijtech.

CHANGELOG_PENDING.md

thanethomson · 2022-08-31T11:27:14Z

@wcsiu just checking in here. This seems like a valuable change for us to have, but it needs some minor updates.

wcsiu · 2022-08-31T11:34:38Z

@wcsiu just checking in here. This seems like a valuable change for us to have, but it needs some minor updates.

I agree with your suggestions. I will update the code according to them. I am having a busy week. I will try to finish it in the coming few days. Thank you.

thanethomson · 2022-08-31T11:42:03Z

I agree with your suggestions. I will update the code according to them. I am having a busy week. I will try to finish it in the coming few days. Thank you.

No rush 🙂 Just wanted to check in. Thanks very much!

wcsiu · 2022-09-07T15:26:26Z

@thanethomson @elias-orijtech has agreed the fix is no longer necessary. I think the PR should now be ready.

Co-authored-by: Thane Thomson <connect@thanethomson.com>

Similar to Tendermint's PR, tendermint/tendermint#9250 Note that crypto/ledger is not updated in this PR, because if its dependency on the R and S values being exposed by ParseDERSignature. Updates cosmos#13423 Signed-off-by: Elias Naur <elias@orijtech.com>

Similar to Tendermint's PR, tendermint/tendermint#9250 Note that crypto/ledger is not updated in this PR, because if its dependency on the R and S values being exposed by ParseDERSignature. Updates #13423 Signed-off-by: Elias Naur <elias@orijtech.com> Signed-off-by: Elias Naur <elias@orijtech.com> Co-authored-by: Marko <marbar3778@yahoo.com>

* secp256k1: upgrade to latest btcec v2 and btcutil * Update CHANGELOG_PENDING.md Co-authored-by: Thane Thomson <connect@thanethomson.com> * fix rebase Co-authored-by: Thane Thomson <connect@thanethomson.com>

…9250) (#9784) * update btcec to v2 and use the latest btcutil (#9250) * secp256k1: upgrade to latest btcec v2 and btcutil * Update CHANGELOG_PENDING.md Co-authored-by: Thane Thomson <connect@thanethomson.com> * fix rebase Co-authored-by: Thane Thomson <connect@thanethomson.com> * Minor spacing Co-authored-by: Wachiu Siu <5212960+wcsiu@users.noreply.github.com> Co-authored-by: Thane Thomson <connect@thanethomson.com>

* secp256k1: upgrade to latest btcec v2 and btcutil * Update CHANGELOG_PENDING.md Co-authored-by: Thane Thomson <connect@thanethomson.com> * fix rebase Co-authored-by: Thane Thomson <connect@thanethomson.com>

…9250) (#9787) * update btcec to v2 and use the latest btcutil (#9250) * secp256k1: upgrade to latest btcec v2 and btcutil * Update CHANGELOG_PENDING.md Co-authored-by: Thane Thomson <connect@thanethomson.com> * fix rebase Co-authored-by: Thane Thomson <connect@thanethomson.com> * go mod tidy Co-authored-by: Wachiu Siu <5212960+wcsiu@users.noreply.github.com> Co-authored-by: Thane Thomson <connect@thanethomson.com>

Similar to Tendermint's PR, tendermint/tendermint#9250 Note that crypto/ledger is not updated in this PR, because if its dependency on the R and S values being exposed by ParseDERSignature. Updates #13423 Signed-off-by: Elias Naur <elias@orijtech.com> Signed-off-by: Elias Naur <elias@orijtech.com> Co-authored-by: Marko <marbar3778@yahoo.com>

wcsiu requested review from ebuchman, cmwaters, tychoish, williambanfield, sergio-mena, jmalicevic, thanethomson and samricotta as code owners August 14, 2022 11:24

This was referenced Aug 14, 2022

Update github.com/btcsuite/btcd versions #9249

Closed

Replace or refine use of github.com/btcsuite/btcd #8698

Closed

wcsiu changed the base branch from master to main August 19, 2022 17:35

wcsiu requested review from a team August 19, 2022 17:35

wcsiu changed the base branch from main to master August 19, 2022 17:37

wcsiu requested review from josef-widder, milosevic and cason as code owners August 22, 2022 14:46

wcsiu changed the base branch from master to main August 22, 2022 14:46

elias-orijtech reviewed Aug 25, 2022

View reviewed changes

thanethomson reviewed Aug 25, 2022

View reviewed changes

CHANGELOG_PENDING.md Outdated Show resolved Hide resolved

thanethomson added the S:wip Work in progress (prevents stalebot from automatically closing) label Sep 2, 2022

secp256k1: upgrade to latest btcec v2 and btcutil

3194760

wcsiu and others added 3 commits September 8, 2022 11:00

Update CHANGELOG_PENDING.md

f9f302f

Co-authored-by: Thane Thomson <connect@thanethomson.com>

fix rebase

8831779

Merge branch 'main' into master

7c0404b

thanethomson approved these changes Sep 9, 2022

View reviewed changes

thanethomson merged commit 0f45086 into tendermint:main Sep 9, 2022

elias-orijtech mentioned this pull request Oct 11, 2022

chore(crypto): update btcec to v2 cosmos/cosmos-sdk#13513

Merged

tnasu mentioned this pull request Nov 21, 2022

build(deps): Bump github.com/btcsuite/btcd from 0.22.1 to 0.23.1 Finschia/ostracon#430

Closed

JayT106 mentioned this pull request Nov 29, 2022

bump github.com/btcsuite/btcd to 0.23.2 or latest version in v0.37 #9783

Closed

sergio-mena added the S:backport-to-v0.37.x Tell mergify to backport the PR to v0.37.x label Nov 29, 2022

sergio-mena mentioned this pull request Nov 29, 2022

[Backport to v0.37.x] update btcec to v2 and use the latest btcutil (#9250) #9784

Merged

3 tasks

sergio-mena mentioned this pull request Nov 29, 2022

[Backport to v0.34.x] update btcec to v2 and use the latest btcutil (#9250) #9787

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

update btcec to v2 and use the latest btcutil #9250

update btcec to v2 and use the latest btcutil #9250

wcsiu commented Aug 14, 2022 •

edited

Loading

cmwaters commented Aug 16, 2022

wcsiu commented Aug 19, 2022 •

edited

Loading

wcsiu commented Aug 22, 2022

odeke-em commented Aug 25, 2022

elias-orijtech left a comment

elias-orijtech Aug 25, 2022

wcsiu Sep 2, 2022 •

edited

Loading

elias-orijtech Sep 5, 2022

wcsiu Sep 7, 2022

thanethomson left a comment

thanethomson commented Aug 31, 2022

wcsiu commented Aug 31, 2022 •

edited

Loading

thanethomson commented Aug 31, 2022

wcsiu commented Sep 7, 2022


		sig, err := priv.Sign(crypto.Sha256(msg))
		sig, err := ecdsa.SignCompact(priv, crypto.Sha256(msg), false)

update btcec to v2 and use the latest btcutil #9250

update btcec to v2 and use the latest btcutil #9250

Conversation

wcsiu commented Aug 14, 2022 • edited Loading

PR checklist

cmwaters commented Aug 16, 2022

wcsiu commented Aug 19, 2022 • edited Loading

wcsiu commented Aug 22, 2022

odeke-em commented Aug 25, 2022

elias-orijtech left a comment

Choose a reason for hiding this comment

elias-orijtech Aug 25, 2022

Choose a reason for hiding this comment

wcsiu Sep 2, 2022 • edited Loading

Choose a reason for hiding this comment

elias-orijtech Sep 5, 2022

Choose a reason for hiding this comment

wcsiu Sep 7, 2022

Choose a reason for hiding this comment

thanethomson left a comment

Choose a reason for hiding this comment

thanethomson commented Aug 31, 2022

wcsiu commented Aug 31, 2022 • edited Loading

thanethomson commented Aug 31, 2022

wcsiu commented Sep 7, 2022

wcsiu commented Aug 14, 2022 •

edited

Loading

wcsiu commented Aug 19, 2022 •

edited

Loading

wcsiu Sep 2, 2022 •

edited

Loading

wcsiu commented Aug 31, 2022 •

edited

Loading