📅 Original date posted:2015-01-22
📝 Original message:To be more in the C++ spirit, I would suggest changing the (const std::vector<unsigned char> &sig, size_t &off) parameters to (std::vector<unsigned char>::const_iterator &itr, std::vector<unsigned char>::const_iterator end).
Example:
bool ConsumeNumber(std::vector<unsigned char>::const_iterator &itr, std::vector<unsigned char>::const_iterator end, unsigned int len)
{
// Length of number should be within signature.
if (itr + len >= end) return false;
// Negative numbers are not allowed.
if (*itr & 0x80) return false;
// Zero bytes at the start are not allowed, unless it would
// otherwise be interpreted as a negative number.
if (len > 1 && (*itr == 0x00) && !(*(itr + 1) & 0x80)) return false;
// Consume number itself.
itr += len;
return true;
}
On Thursday, 22 January 2015, at 11:02 am, Rusty Russell wrote:
> Pieter Wuille <pieter.wuille at gmail.com> writes:
> > Hello everyone,
> >
> > We've been aware of the risk of depending on OpenSSL for consensus
> > rules for a while, and were trying to get rid of this as part of BIP
> > 62 (malleability protection), which was however postponed due to
> > unforeseen complexities. The recent evens (see the thread titled
> > "OpenSSL 1.0.0p / 1.0.1k incompatible, causes blockchain rejection."
> > on this mailing list) have made it clear that the problem is very
> > real, however, and I would prefer to have a fundamental solution for
> > it sooner rather than later.
>
> OK, I worked up a clearer (but more verbose) version with fewer
> magic numbers. More importantly, feel free to steal the test cases.
>
> One weirdness is the restriction on maximum total length, rather than a
> 32 byte (33 with 0-prepad) limit on signatures themselves.
>
> Apologies for my babytalk C++. Am sure there's a neater way.
>
> /* Licensed under Creative Commons zero (public domain). */
> #include <vector>
> #include <cstdlib>
> #include <cassert>
>
> #ifdef CLARIFY
> bool ConsumeByte(const std::vector<unsigned char> &sig, size_t &off,
> unsigned int &val)
> {
> if (off >= sig.size()) return false;
>
> val = sig[off++];
> return true;
> }
>
> bool ConsumeTypeByte(const std::vector<unsigned char> &sig, size_t &off,
> unsigned int t)
> {
> unsigned int type;
> if (!ConsumeByte(sig, off, type)) return false;
>
> return (type == t);
> }
>
> bool ConsumeNonZeroLength(const std::vector<unsigned char> &sig, size_t &off,
> unsigned int &len)
> {
> if (!ConsumeByte(sig, off, len)) return false;
>
> // Zero-length integers are not allowed.
> return (len != 0);
> }
>
> bool ConsumeNumber(const std::vector<unsigned char> &sig, size_t &off,
> unsigned int len)
> {
> // Length of number should be within signature.
> if (off + len > sig.size()) return false;
>
> // Negative numbers are not allowed.
> if (sig[off] & 0x80) return false;
>
> // Zero bytes at the start are not allowed, unless it would
> // otherwise be interpreted as a negative number.
> if (len > 1 && (sig[off] == 0x00) && !(sig[off+1] & 0x80)) return false;
>
> // Consume number itself.
> off += len;
> return true;
> }
>
> // Consume a DER encoded integer, update off if successful.
> bool ConsumeDERInteger(const std::vector<unsigned char> &sig, size_t &off) {
> unsigned int len;
>
> // Type byte must be "integer"
> if (!ConsumeTypeByte(sig, off, 0x02)) return false;
> if (!ConsumeNonZeroLength(sig, off, len)) return false;
> // Now the BE encoded value itself.
> if (!ConsumeNumber(sig, off, len)) return false;
>
> return true;
> }
>
> bool IsValidSignatureEncoding(const std::vector<unsigned char> &sig) {
> // Format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S] [sighash]
> // * total-length: 1-byte length descriptor of everything that follows,
> // excluding the sighash byte.
> // * R-length: 1-byte length descriptor of the R value that follows.
> // * R: arbitrary-length big-endian encoded R value. It cannot start with any
> // null bytes, unless the first byte that follows is 0x80 or higher, in which
> // case a single null byte is required.
> // * S-length: 1-byte length descriptor of the S value that follows.
> // * S: arbitrary-length big-endian encoded S value. The same rules apply.
> // * sighash: 1-byte value indicating what data is hashed.
>
> // Accept empty signature as correctly encoded (but invalid) signature,
> // even though it is not strictly DER.
> if (sig.size() == 0) return true;
>
> // Maximum size constraint.
> if (sig.size() > 73) return false;
>
> size_t off = 0;
>
> // A signature is of type "compound".
> if (!ConsumeTypeByte(sig, off, 0x30)) return false;
>
> unsigned int len;
> if (!ConsumeNonZeroLength(sig, off, len)) return false;
>
> // Make sure the length covers the rest (except sighash).
> if (len + 1 != sig.size() - off) return false;
>
> // Check R value.
> if (!ConsumeDERInteger(sig, off)) return false;
>
> // Check S value.
> if (!ConsumeDERInteger(sig, off)) return false;
>
> // There should exactly one byte left (the sighash).
> return off + 1 == sig.size() ? true : false;
> }
> #else
> bool IsValidSignatureEncoding(const std::vector<unsigned char> &sig) {
> // Format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S] [sighash]
> // * total-length: 1-byte length descriptor of everything that follows,
> // excluding the sighash byte.
> // * R-length: 1-byte length descriptor of the R value that follows.
> // * R: arbitrary-length big-endian encoded R value. It must use the shortest
> // possible encoding for a positive integers (which means no null bytes at
> // the start, except a single one when the next byte has its highest bit set).
> // * S-length: 1-byte length descriptor of the S value that follows.
> // * S: arbitrary-length big-endian encoded S value. The same rules apply.
> // * sighash: 1-byte value indicating what data is hashed (not part of the DER
> // signature)
>
> // Accept empty signature as correctly encoded (but invalid) signature,
> // even though it is not strictly DER. This avoids needing full DER signatures
> // in places where any invalid signature would do. Given that the empty string is
> // always invalid as signature, this is safe.
> if (sig.size() == 0) return true;
>
> // Minimum and maximum size constraints.
> if (sig.size() < 9) return false;
> if (sig.size() > 73) return false;
>
> // A signature is of type 0x30 (compound).
> if (sig[0] != 0x30) return false;
>
> // Make sure the length covers the entire signature.
> if (sig[1] != sig.size() - 3) return false;
>
> // Extract the length of the R element.
> unsigned int lenR = sig[3];
>
> // Make sure the length of the S element is still inside the signature.
> if (5 + lenR >= sig.size()) return false;
>
> // Extract the length of the S element.
> unsigned int lenS = sig[5 + lenR];
>
> // Verify that the length of the signature matches the sum of the length
> // of the elements.
> if ((size_t)(lenR + lenS + 7) != sig.size()) return false;
>
> // Check whether the R element is an integer.
> if (sig[2] != 0x02) return false;
>
> // Zero-length integers are not allowed for R.
> if (lenR == 0) return false;
>
> // Negative numbers are not allowed for R.
> if (sig[4] & 0x80) return false;
>
> // Null bytes at the start of R are not allowed, unless R would
> // otherwise be interpreted as a negative number.
> if (lenR > 1 && (sig[4] == 0x00) && !(sig[5] & 0x80)) return false;
>
> // Check whether the S element is an integer.
> if (sig[lenR + 4] != 0x02) return false;
>
> // Zero-length integers are not allowed for S.
> if (lenS == 0) return false;
>
> // Negative numbers are not allowed for S.
> if (sig[lenR + 6] & 0x80) return false;
>
> // Null bytes at the start of S are not allowed, unless S would otherwise be
> // interpreted as a negative number.
> if (lenS > 1 && (sig[lenR + 6] == 0x00) && !(sig[lenR + 7] & 0x80)) return false;
>
> return true;
> }
> #endif
>
> #define COMPOUND 0x30
> #define NOT_COMPOUND 0x31
>
> // Len gets adjusted by check() to be actual length with this offset.
> #define LEN_OK 0
> #define LEN_TOO_BIG 1
> #define LEN_TOO_SMALL 0xff
>
> #define INT 0x02
> #define NOT_INT 0x03
>
> #define MINIMAL_SIGLEN 1
> #define MINIMAL_SIGVAL 0x0
>
> #define NORMAL_SIGLEN 32
> #define NORMAL_SIGVAL(S) S, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, \
> 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, \
> 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, \
> 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
>
> // 33 bytes is possible, with 0 prepended.
> #define MAXIMAL_SIGLEN 33
> #define MAXIMAL_SIGVAL(S) NORMAL_SIGVAL(S), 0x20
>
> #define OVERSIZE_SIGLEN 34
> #define OVERSIZE_SIGVAL(S) MAXIMAL_SIGVAL(S), 0x21
>
> #define ZEROPAD_SIGLEN (1 + NORMAL_SIGLEN)
> #define ZEROPAD_SIGVAL(S) 00, NORMAL_SIGVAL(S)
>
> #define SIGHASH 0xf0
>
> static bool check(const std::vector<unsigned char> &sig)
> {
> std::vector<unsigned char> fixed = sig;
>
> // Fixup length
> if (fixed.size() > 1)
> fixed[1] += fixed.size() - 3;
> return IsValidSignatureEncoding(fixed);
> }
>
> #define good(arr) assert(check(std::vector<unsigned char>(arr, arr+sizeof(arr))))
> #define bad(arr) assert(!check(std::vector<unsigned char>(arr, arr+sizeof(arr))))
>
> // The OK cases.
> static unsigned char zerolen[] = { };
> static unsigned char normal[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char min_r[] = { COMPOUND, LEN_OK,
> INT, MINIMAL_SIGLEN, MINIMAL_SIGVAL,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char min_s[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, MINIMAL_SIGLEN, MINIMAL_SIGVAL,
> SIGHASH };
> static unsigned char max_r[] = { COMPOUND, LEN_OK,
> INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char max_s[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x2),
> SIGHASH };
> // As long as total size doesn't go over, a single sig is allowed > 33 bytes
> static unsigned char wierd_s_len[] = { COMPOUND, LEN_OK,
> INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char wierd_r_len[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x2),
> SIGHASH };
> static unsigned char zeropad_s[] = { COMPOUND, LEN_OK,
> INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x81),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char zeropad_r[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x82),
> SIGHASH };
>
>
> // The fail cases.
> static unsigned char not_compound[] = { NOT_COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char short_len[] = { COMPOUND, LEN_TOO_SMALL,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char long_len[] = { COMPOUND, LEN_TOO_BIG,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char r_notint[] = { COMPOUND, LEN_OK,
> NOT_INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char s_notint[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> NOT_INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char s_oversig[] = { COMPOUND, LEN_OK,
> INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x1),
> INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char r_oversig[] = { COMPOUND, LEN_OK,
> INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x1),
> INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x2),
> SIGHASH };
> static unsigned char s_negative[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x81),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char r_negative[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x82),
> SIGHASH };
> static unsigned char zeropad_bad_s[] = { COMPOUND, LEN_OK,
> INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char zeropad_bad_r[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x2),
> SIGHASH };
> static unsigned char missing_sighash[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2) };
> static unsigned char extra_byte[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH, 0 };
>
> // Bad signature lengths
> static unsigned char zerolen_r[] = { COMPOUND, LEN_OK,
> INT, 0,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char zerolen_s[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, 0,
> SIGHASH };
> static unsigned char overlen_r_by_1[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN + 1 + 1 + NORMAL_SIGLEN + 1 + 1, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char overlen_s_by_1[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN+1+1, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char underlen_r_by_1[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN-1, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),
> SIGHASH };
> static unsigned char underlen_s_by_1[] = { COMPOUND, LEN_OK,
> INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),
> INT, NORMAL_SIGLEN-1, NORMAL_SIGVAL(0x2),
> SIGHASH };
>
> int main()
> {
> good(zerolen);
> good(normal);
> good(min_r);
> good(min_s);
> good(max_r);
> good(max_s);
> good(wierd_s_len);
> good(wierd_r_len);
> good(zeropad_s);
> good(zeropad_r);
>
> // Try different amounts of truncation.
> for (size_t i = 1; i < sizeof(normal)-1; i++)
> assert(!check(std::vector<unsigned char>(normal, normal+i)));
>
> bad(not_compound);
> bad(short_len);
> bad(long_len);
> bad(r_notint);
> bad(s_notint);
> bad(s_oversig);
> bad(r_oversig);
> bad(s_negative);
> bad(r_negative);
> bad(s_negative);
> bad(r_negative);
> bad(zeropad_bad_s);
> bad(zeropad_bad_r);
> bad(zerolen_r);
> bad(zerolen_s);
> bad(overlen_r_by_1);
> bad(overlen_s_by_1);
> bad(underlen_r_by_1);
> bad(underlen_s_by_1);
> bad(missing_sighash);
> bad(extra_byte);
>
> return 0;
> }
>
>
>
> ------------------------------------------------------------------------------
> New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
> GigeNET is offering a free month of service with a new server in Ashburn.
> Choose from 2 high performing configs, both with 100TB of bandwidth.
> Higher redundancy.Lower latency.Increased capacity.Completely compliant.
> http://p.sf.net/sfu/gigenet
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
Matt Whitlock [ARCHIVE] /
npub17q…upwet
2023-06-07 15:28:55
in reply to nevent1q…yglp
Author Public Key
npub17qxssk9sj2r7jswvh3y32e7vwz7mcckhz33gk9nurdmw0lhsfkgswupwetPublished at
2023-06-07 15:28:55Event JSON
{
"id": "105a592238feaa5f03174d096cb30e7aa717909bb4cb7426a241bcf7fe4760fc",
"pubkey": "f00d0858b09287e941ccbc491567cc70bdbc62d714628b167c1b76e7fef04d91",
"created_at": 1686151735,
"kind": 1,
"tags": [
[
"e",
"43498997aaf69cc28c108f60f2a0a9a1eeab544cf4e7f9ece35a133ac15cb4c1",
"",
"root"
],
[
"e",
"57cdae112ad537d91421e604c9bf784a9ab0b6bcc37477ef13935513346af8e6",
"",
"reply"
],
[
"p",
"adcb53cdbd72e2a0c22452a9087f173c6b55edc7b504ff9b861e9c02af9a87d4"
]
],
"content": "📅 Original date posted:2015-01-22\n📝 Original message:To be more in the C++ spirit, I would suggest changing the (const std::vector\u003cunsigned char\u003e \u0026sig, size_t \u0026off) parameters to (std::vector\u003cunsigned char\u003e::const_iterator \u0026itr, std::vector\u003cunsigned char\u003e::const_iterator end).\n\nExample:\n\nbool ConsumeNumber(std::vector\u003cunsigned char\u003e::const_iterator \u0026itr, std::vector\u003cunsigned char\u003e::const_iterator end, unsigned int len)\n{\n\t// Length of number should be within signature.\n\tif (itr + len \u003e= end) return false;\n \n\t// Negative numbers are not allowed.\n\tif (*itr \u0026 0x80) return false;\n \n\t// Zero bytes at the start are not allowed, unless it would\n\t// otherwise be interpreted as a negative number.\n\tif (len \u003e 1 \u0026\u0026 (*itr == 0x00) \u0026\u0026 !(*(itr + 1) \u0026 0x80)) return false;\n \n\t// Consume number itself.\n\titr += len;\n\treturn true;\n}\n\n\nOn Thursday, 22 January 2015, at 11:02 am, Rusty Russell wrote:\n\u003e Pieter Wuille \u003cpieter.wuille at gmail.com\u003e writes:\n\u003e \u003e Hello everyone,\n\u003e \u003e\n\u003e \u003e We've been aware of the risk of depending on OpenSSL for consensus\n\u003e \u003e rules for a while, and were trying to get rid of this as part of BIP\n\u003e \u003e 62 (malleability protection), which was however postponed due to\n\u003e \u003e unforeseen complexities. The recent evens (see the thread titled\n\u003e \u003e \"OpenSSL 1.0.0p / 1.0.1k incompatible, causes blockchain rejection.\"\n\u003e \u003e on this mailing list) have made it clear that the problem is very\n\u003e \u003e real, however, and I would prefer to have a fundamental solution for\n\u003e \u003e it sooner rather than later.\n\u003e \n\u003e OK, I worked up a clearer (but more verbose) version with fewer\n\u003e magic numbers. More importantly, feel free to steal the test cases.\n\u003e \n\u003e One weirdness is the restriction on maximum total length, rather than a\n\u003e 32 byte (33 with 0-prepad) limit on signatures themselves.\n\u003e \n\u003e Apologies for my babytalk C++. Am sure there's a neater way.\n\u003e \n\u003e /* Licensed under Creative Commons zero (public domain). */\n\u003e #include \u003cvector\u003e\n\u003e #include \u003ccstdlib\u003e\n\u003e #include \u003ccassert\u003e\n\u003e \n\u003e #ifdef CLARIFY\n\u003e bool ConsumeByte(const std::vector\u003cunsigned char\u003e \u0026sig, size_t \u0026off,\n\u003e unsigned int \u0026val)\n\u003e {\n\u003e if (off \u003e= sig.size()) return false;\n\u003e \n\u003e val = sig[off++];\n\u003e return true;\n\u003e }\n\u003e \n\u003e bool ConsumeTypeByte(const std::vector\u003cunsigned char\u003e \u0026sig, size_t \u0026off,\n\u003e unsigned int t)\n\u003e {\n\u003e unsigned int type;\n\u003e if (!ConsumeByte(sig, off, type)) return false;\n\u003e \n\u003e return (type == t);\n\u003e }\n\u003e \n\u003e bool ConsumeNonZeroLength(const std::vector\u003cunsigned char\u003e \u0026sig, size_t \u0026off,\n\u003e unsigned int \u0026len)\n\u003e {\n\u003e if (!ConsumeByte(sig, off, len)) return false;\n\u003e \n\u003e // Zero-length integers are not allowed.\n\u003e return (len != 0);\n\u003e }\n\u003e \n\u003e bool ConsumeNumber(const std::vector\u003cunsigned char\u003e \u0026sig, size_t \u0026off,\n\u003e unsigned int len)\n\u003e {\n\u003e // Length of number should be within signature.\n\u003e if (off + len \u003e sig.size()) return false;\n\u003e \n\u003e // Negative numbers are not allowed.\n\u003e if (sig[off] \u0026 0x80) return false;\n\u003e \n\u003e // Zero bytes at the start are not allowed, unless it would\n\u003e // otherwise be interpreted as a negative number.\n\u003e if (len \u003e 1 \u0026\u0026 (sig[off] == 0x00) \u0026\u0026 !(sig[off+1] \u0026 0x80)) return false;\n\u003e \n\u003e // Consume number itself.\n\u003e off += len;\n\u003e return true;\n\u003e }\n\u003e \n\u003e // Consume a DER encoded integer, update off if successful.\n\u003e bool ConsumeDERInteger(const std::vector\u003cunsigned char\u003e \u0026sig, size_t \u0026off) {\n\u003e unsigned int len;\n\u003e \n\u003e // Type byte must be \"integer\"\n\u003e if (!ConsumeTypeByte(sig, off, 0x02)) return false;\n\u003e if (!ConsumeNonZeroLength(sig, off, len)) return false;\n\u003e // Now the BE encoded value itself.\n\u003e if (!ConsumeNumber(sig, off, len)) return false;\n\u003e \n\u003e return true;\n\u003e }\n\u003e \n\u003e bool IsValidSignatureEncoding(const std::vector\u003cunsigned char\u003e \u0026sig) {\n\u003e // Format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S] [sighash]\n\u003e // * total-length: 1-byte length descriptor of everything that follows,\n\u003e // excluding the sighash byte.\n\u003e // * R-length: 1-byte length descriptor of the R value that follows.\n\u003e // * R: arbitrary-length big-endian encoded R value. It cannot start with any\n\u003e // null bytes, unless the first byte that follows is 0x80 or higher, in which\n\u003e // case a single null byte is required.\n\u003e // * S-length: 1-byte length descriptor of the S value that follows.\n\u003e // * S: arbitrary-length big-endian encoded S value. The same rules apply.\n\u003e // * sighash: 1-byte value indicating what data is hashed.\n\u003e \n\u003e // Accept empty signature as correctly encoded (but invalid) signature,\n\u003e // even though it is not strictly DER.\n\u003e if (sig.size() == 0) return true;\n\u003e \n\u003e // Maximum size constraint.\n\u003e if (sig.size() \u003e 73) return false;\n\u003e \n\u003e size_t off = 0;\n\u003e \n\u003e // A signature is of type \"compound\".\n\u003e if (!ConsumeTypeByte(sig, off, 0x30)) return false;\n\u003e \n\u003e unsigned int len;\n\u003e if (!ConsumeNonZeroLength(sig, off, len)) return false;\n\u003e \n\u003e // Make sure the length covers the rest (except sighash).\n\u003e if (len + 1 != sig.size() - off) return false;\n\u003e \n\u003e // Check R value.\n\u003e if (!ConsumeDERInteger(sig, off)) return false;\n\u003e \n\u003e // Check S value.\n\u003e if (!ConsumeDERInteger(sig, off)) return false;\n\u003e \n\u003e // There should exactly one byte left (the sighash).\n\u003e return off + 1 == sig.size() ? true : false;\n\u003e }\n\u003e #else\n\u003e bool IsValidSignatureEncoding(const std::vector\u003cunsigned char\u003e \u0026sig) {\n\u003e // Format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S] [sighash]\n\u003e // * total-length: 1-byte length descriptor of everything that follows,\n\u003e // excluding the sighash byte.\n\u003e // * R-length: 1-byte length descriptor of the R value that follows.\n\u003e // * R: arbitrary-length big-endian encoded R value. It must use the shortest\n\u003e // possible encoding for a positive integers (which means no null bytes at\n\u003e // the start, except a single one when the next byte has its highest bit set).\n\u003e // * S-length: 1-byte length descriptor of the S value that follows.\n\u003e // * S: arbitrary-length big-endian encoded S value. The same rules apply.\n\u003e // * sighash: 1-byte value indicating what data is hashed (not part of the DER\n\u003e // signature)\n\u003e \n\u003e // Accept empty signature as correctly encoded (but invalid) signature,\n\u003e // even though it is not strictly DER. This avoids needing full DER signatures\n\u003e // in places where any invalid signature would do. Given that the empty string is\n\u003e // always invalid as signature, this is safe.\n\u003e if (sig.size() == 0) return true;\n\u003e \n\u003e // Minimum and maximum size constraints.\n\u003e if (sig.size() \u003c 9) return false;\n\u003e if (sig.size() \u003e 73) return false;\n\u003e \n\u003e // A signature is of type 0x30 (compound).\n\u003e if (sig[0] != 0x30) return false;\n\u003e \n\u003e // Make sure the length covers the entire signature.\n\u003e if (sig[1] != sig.size() - 3) return false;\n\u003e \n\u003e // Extract the length of the R element.\n\u003e unsigned int lenR = sig[3];\n\u003e \n\u003e // Make sure the length of the S element is still inside the signature.\n\u003e if (5 + lenR \u003e= sig.size()) return false;\n\u003e \n\u003e // Extract the length of the S element.\n\u003e unsigned int lenS = sig[5 + lenR];\n\u003e \n\u003e // Verify that the length of the signature matches the sum of the length\n\u003e // of the elements.\n\u003e if ((size_t)(lenR + lenS + 7) != sig.size()) return false;\n\u003e \n\u003e // Check whether the R element is an integer.\n\u003e if (sig[2] != 0x02) return false;\n\u003e \n\u003e // Zero-length integers are not allowed for R.\n\u003e if (lenR == 0) return false;\n\u003e \n\u003e // Negative numbers are not allowed for R.\n\u003e if (sig[4] \u0026 0x80) return false;\n\u003e \n\u003e // Null bytes at the start of R are not allowed, unless R would\n\u003e // otherwise be interpreted as a negative number.\n\u003e if (lenR \u003e 1 \u0026\u0026 (sig[4] == 0x00) \u0026\u0026 !(sig[5] \u0026 0x80)) return false;\n\u003e \n\u003e // Check whether the S element is an integer.\n\u003e if (sig[lenR + 4] != 0x02) return false;\n\u003e \n\u003e // Zero-length integers are not allowed for S.\n\u003e if (lenS == 0) return false;\n\u003e \n\u003e // Negative numbers are not allowed for S.\n\u003e if (sig[lenR + 6] \u0026 0x80) return false;\n\u003e \n\u003e // Null bytes at the start of S are not allowed, unless S would otherwise be\n\u003e // interpreted as a negative number.\n\u003e if (lenS \u003e 1 \u0026\u0026 (sig[lenR + 6] == 0x00) \u0026\u0026 !(sig[lenR + 7] \u0026 0x80)) return false;\n\u003e \n\u003e return true;\n\u003e }\n\u003e #endif\n\u003e \n\u003e #define COMPOUND 0x30\n\u003e #define NOT_COMPOUND 0x31\n\u003e \n\u003e // Len gets adjusted by check() to be actual length with this offset.\n\u003e #define LEN_OK 0\n\u003e #define LEN_TOO_BIG 1\n\u003e #define LEN_TOO_SMALL 0xff\n\u003e \n\u003e #define INT 0x02\n\u003e #define NOT_INT 0x03\n\u003e \n\u003e #define MINIMAL_SIGLEN 1\n\u003e #define MINIMAL_SIGVAL 0x0\n\u003e \n\u003e #define NORMAL_SIGLEN 32\n\u003e #define NORMAL_SIGVAL(S) S, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, \\\n\u003e 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, \\\n\u003e 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, \\\n\u003e 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f\n\u003e \n\u003e // 33 bytes is possible, with 0 prepended.\n\u003e #define MAXIMAL_SIGLEN 33\n\u003e #define MAXIMAL_SIGVAL(S) NORMAL_SIGVAL(S), 0x20\n\u003e \n\u003e #define OVERSIZE_SIGLEN 34\n\u003e #define OVERSIZE_SIGVAL(S) MAXIMAL_SIGVAL(S), 0x21\n\u003e \n\u003e #define ZEROPAD_SIGLEN (1 + NORMAL_SIGLEN)\n\u003e #define ZEROPAD_SIGVAL(S) 00, NORMAL_SIGVAL(S)\n\u003e \n\u003e #define SIGHASH 0xf0\n\u003e \n\u003e static bool check(const std::vector\u003cunsigned char\u003e \u0026sig)\n\u003e {\n\u003e std::vector\u003cunsigned char\u003e fixed = sig;\n\u003e \n\u003e // Fixup length\n\u003e if (fixed.size() \u003e 1)\n\u003e fixed[1] += fixed.size() - 3;\n\u003e return IsValidSignatureEncoding(fixed);\n\u003e }\n\u003e \n\u003e #define good(arr) assert(check(std::vector\u003cunsigned char\u003e(arr, arr+sizeof(arr))))\n\u003e #define bad(arr) assert(!check(std::vector\u003cunsigned char\u003e(arr, arr+sizeof(arr))))\n\u003e \n\u003e // The OK cases.\n\u003e static unsigned char zerolen[] = { };\n\u003e static unsigned char normal[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char min_r[] = { COMPOUND, LEN_OK,\n\u003e INT, MINIMAL_SIGLEN, MINIMAL_SIGVAL,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char min_s[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, MINIMAL_SIGLEN, MINIMAL_SIGVAL,\n\u003e SIGHASH };\n\u003e static unsigned char max_r[] = { COMPOUND, LEN_OK,\n\u003e INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char max_s[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e // As long as total size doesn't go over, a single sig is allowed \u003e 33 bytes\n\u003e static unsigned char wierd_s_len[] = { COMPOUND, LEN_OK,\n\u003e INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char wierd_r_len[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char zeropad_s[] = { COMPOUND, LEN_OK,\n\u003e INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x81),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char zeropad_r[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x82),\n\u003e SIGHASH };\n\u003e \n\u003e \n\u003e // The fail cases.\n\u003e static unsigned char not_compound[] = { NOT_COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char short_len[] = { COMPOUND, LEN_TOO_SMALL,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char long_len[] = { COMPOUND, LEN_TOO_BIG,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char r_notint[] = { COMPOUND, LEN_OK,\n\u003e NOT_INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char s_notint[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e NOT_INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char s_oversig[] = { COMPOUND, LEN_OK,\n\u003e INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x1),\n\u003e INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char r_oversig[] = { COMPOUND, LEN_OK,\n\u003e INT, MAXIMAL_SIGLEN, MAXIMAL_SIGVAL(0x1),\n\u003e INT, OVERSIZE_SIGLEN, OVERSIZE_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char s_negative[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x81),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char r_negative[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x82),\n\u003e SIGHASH };\n\u003e static unsigned char zeropad_bad_s[] = { COMPOUND, LEN_OK,\n\u003e INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char zeropad_bad_r[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, ZEROPAD_SIGLEN, ZEROPAD_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char missing_sighash[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2) };\n\u003e static unsigned char extra_byte[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH, 0 };\n\u003e \n\u003e // Bad signature lengths\n\u003e static unsigned char zerolen_r[] = { COMPOUND, LEN_OK,\n\u003e INT, 0,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char zerolen_s[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, 0,\n\u003e SIGHASH };\n\u003e static unsigned char overlen_r_by_1[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN + 1 + 1 + NORMAL_SIGLEN + 1 + 1, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char overlen_s_by_1[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN+1+1, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char underlen_r_by_1[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN-1, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e static unsigned char underlen_s_by_1[] = { COMPOUND, LEN_OK,\n\u003e INT, NORMAL_SIGLEN, NORMAL_SIGVAL(0x1),\n\u003e INT, NORMAL_SIGLEN-1, NORMAL_SIGVAL(0x2),\n\u003e SIGHASH };\n\u003e \n\u003e int main()\n\u003e {\n\u003e good(zerolen);\n\u003e good(normal);\n\u003e good(min_r);\n\u003e good(min_s);\n\u003e good(max_r);\n\u003e good(max_s);\n\u003e good(wierd_s_len);\n\u003e good(wierd_r_len);\n\u003e good(zeropad_s);\n\u003e good(zeropad_r);\n\u003e \n\u003e // Try different amounts of truncation.\n\u003e for (size_t i = 1; i \u003c sizeof(normal)-1; i++)\n\u003e assert(!check(std::vector\u003cunsigned char\u003e(normal, normal+i)));\n\u003e \n\u003e bad(not_compound);\n\u003e bad(short_len);\n\u003e bad(long_len);\n\u003e bad(r_notint);\n\u003e bad(s_notint);\n\u003e bad(s_oversig);\n\u003e bad(r_oversig);\n\u003e bad(s_negative);\n\u003e bad(r_negative);\n\u003e bad(s_negative);\n\u003e bad(r_negative);\n\u003e bad(zeropad_bad_s);\n\u003e bad(zeropad_bad_r);\n\u003e bad(zerolen_r);\n\u003e bad(zerolen_s);\n\u003e bad(overlen_r_by_1);\n\u003e bad(overlen_s_by_1);\n\u003e bad(underlen_r_by_1);\n\u003e bad(underlen_s_by_1);\n\u003e bad(missing_sighash);\n\u003e bad(extra_byte);\n\u003e \n\u003e return 0;\n\u003e }\n\u003e \n\u003e \n\u003e \n\u003e ------------------------------------------------------------------------------\n\u003e New Year. New Location. New Benefits. New Data Center in Ashburn, VA.\n\u003e GigeNET is offering a free month of service with a new server in Ashburn.\n\u003e Choose from 2 high performing configs, both with 100TB of bandwidth.\n\u003e Higher redundancy.Lower latency.Increased capacity.Completely compliant.\n\u003e http://p.sf.net/sfu/gigenet\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development",
"sig": "66d2e877b236f8265e690220c36f287c5f0ff910220c4072704dee7c827b04d7aefafb6e4aa640678a353c2a08389a2c24c60298d6d3213946a02fdd61f4343e"
}