Topic: bitcoinjs-lib and related repos are not 100% RFC6979 compliant (only 99.999...%) (Read 2139 times)

#if USE_RFC6979
	// generate K deterministically
	if (generate_k_rfc6979(&k, priv_key, digest) != 0) {    <<< this stores the k value into &k
		return 1;
	}
#else
	// generate random number k
	if (generate_k_random(&k) != 0) {
		return 1;
	}
#endif

	// compute k*G
	scalar_multiply(&k, &R);    <<< this calcs kG and stores it into &R
	if (pby) {
		*pby = R.y.val[0] & 1;
	}
	// r = (rx mod n)
	bn_mod(&R.x, &order256k1);
	// if r is zero, we fail
	if (bn_is_zero(&R.x)) return 2;
	bn_inverse(&k, &order256k1);      <<< this takes the modular inverse of &k over the order of secp256k1, and places it back into &k (Now &k is = (k)^-1)
	bn_read_be(priv_key, da);
	bn_multiply(&R.x, da, &order256k1);   <<< multiplies da * r and stores it into da
	for (i = 0; i < 8; i++) {
		da->val[i] += z.val[i];
		da->val[i + 1] += (da->val[i] >> 30);
		da->val[i] &= 0x3FFFFFFF;
	}
	da->val[8] += z.val[8];                  <<< This for loop and the operation after it adds the hash of the message (z) to (da*r) and stores it into da... (now da is = z+(da*r) )
	bn_multiply(da, &k, &order256k1);    <<< multiplies &k * da and stores it into &k   (Now &k is = k^-1 * (z + (da * r)).... which is = s)
	bn_mod(&k, &order256k1);               <<< mod &k (which is s) over the order.
	// if k is zero, we fail
	if (bn_is_zero(&k)) return 3;           <<< checking the s value if it is 0
...
...
...
within generate_k_rfc6979 we actually have a check for if k is 0 or not... Line 285
		if ( !bn_is_zero(secret) && bn_is_less(secret, &order256k1) ) {  <<< checking if k is in between 1 and the order - 1 (inclusive)
			return 0; // good number -> no error
		}

--- a/ecdsa.c
+++ b/ecdsa.c
@@ -280,8 +280,8 @@ int generate_k_rfc6979(bignum256 *secret, const uint8_t *pri
        hmac_sha256(k, sizeof(k), v, sizeof(k), v);
 
        for (i = 0; i < 10000; i++) {
-               hmac_sha256(k, sizeof(k), v, sizeof(v), t);
-               bn_read_be(t, secret);
+               hmac_sha256(k, sizeof(k), v, sizeof(v), v);
+               bn_read_be(v, secret);
                if ( !bn_is_zero(secret) && bn_is_less(secret, &order256k1) ) {
                        return 0; // good number -> no error
                }