bitcoinj / bitcoinj / 1704

61%

Pull #1281

travis-ci

Bugfixes for signature verification with native secp256k1 library

Calling verify(byte[], ECDSASignature, byte[]) with the native secp256k1 library would fail on non-canonicalized (not low-S) signatures. The Java counterpart ECDSASigner.verifySignature() allows non-canonical signatures. When relaying and mining, non-canonical signatures are not allowed, but this is checked for in TransactionSignature.decodeFromBitcoin(). The fix is to canonicalize the signature.

Calling verify(byte[], byte[], byte[]) with the native secp256k1 library would ignore the FAKE_SIGNATURES flag. Since this method also needs to allow low-S signatures, it has been modified to instead chain to verify(byte[], ECDSASignature, byte[]).

To improve native performance, it would be best if the canonicalizing happened in the native library via secp256k1_ecdsa_signature_normalize(ctx, &sig, &sig). However, it would require an API change in both bitcoinj and secp256k1 because the expected behavior in secp256k1 is to fail non-normalized signatures (this is evident in their testing suite). The API change could be either a normalization flag passed to the verify method, or a new method (normalize a byte[] signature).

248 of 248 new or added lines in 2 files covered. (100.0%)

15009 of 21015 relevant lines covered (71.42%)

0.71 hits per line