secp

一个灵活且安全的 secp256k1 椭圆曲线数学库，具有常时支持和卓越的人体工程学设计。

secp 充分利用 Rust 的 std::ops 特性，使椭圆曲线密码学代码易于阅读、编写、简洁、易读且安全。

示例

以下是一个使用 secp crate 实现简单 Schnorr 签名的示例。

use secp::{MaybeScalar, Point, Scalar};
use sha2::{Digest, Sha256};

fn compute_challenge(nonce_point: &Point, pubkey: &Point, msg: &[u8]) -> MaybeScalar {
    let hash: [u8; 32] = Sha256::new()
        .chain_update(&nonce_point.serialize())
        .chain_update(&pubkey.serialize())
        .chain_update(msg)
        .finalize()
        .into();
    MaybeScalar::reduce_from(&hash)
}

fn random_scalar() -> Scalar {
    // In an actual implementation this would produce a scalar value
    // sampled from a CSPRNG.
    Scalar::two()
}

fn schnorr_sign(secret_key: Scalar, message: &[u8]) -> (Point, MaybeScalar) {
    let nonce = random_scalar();
    let nonce_point = nonce.base_point_mul();
    let pubkey = secret_key.base_point_mul();

    let e = compute_challenge(&nonce_point, &pubkey, message);
    let s = nonce + secret_key * e;
    (nonce_point, s)
}

fn schnorr_verify(public_key: Point, signature: (Point, MaybeScalar), message: &[u8]) -> bool {
    let (r, s) = signature;
    let e = compute_challenge(&r, &public_key, message);
    s.base_point_mul() == r + e * public_key
}

let secret_key: Scalar = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
    .parse()
    .unwrap();
let public_key = secret_key.base_point_mul();

let message = b"I am the dragon!";

let signature = schnorr_sign(secret_key, message);
assert!(schnorr_verify(public_key, signature, message));

后端选择

此 crate 不直接实现椭圆曲线点数学。相反，我们依赖于两个信誉良好的椭圆曲线密码学库之一

• C 绑定到 libsecp256k1，通过 secp256k1 crate，由 Bitcoin Core 团队维护。
• 通过 k256 crate 的纯 Rust 实现，由 RustCrypto 团队维护。

两者之一均可使用。 默认情况下，此 crate 优先依赖于 libsecp256k1，因为这是在任何地方都可以找到的最经过验证和公众信任的 secp256k1 曲线数学实现。但是，如果您需要纯 Rust 实现，则可以不安装它，并使用纯 Rust 的 k256 crate。

cargo add secp --no-default-features --features k256

如果同时启用了 k256 和 secp256k1 特性，则默认使用 libsecp256k1 绑定进行实际数学运算，但仍提供 trait 实现，使此 crate 可与 k256 互操作。

文档

要查看 API 文档，请访问 docs.rs。

命令行界面

这个crate还提供了一个用于在shell中计算secp256k1曲线操作的CLI工具。使用make cli构建它。二进制文件将生成在target/release/secp。

Usage:

-- Scalar operations --
  secp scalar gen                           Generate a random scalar.
  secp scalar add <scalar> [<scalar>...]    Sum two or more scalars.
  secp scalar mul <scalar> [<scalar>...]    Multiply two or more scalars.
  secp scalar inv <scalar>                  Multiplicative inverse of a scalar mod n.

-- Point operations --
  secp scalar gen                           Generate a random point.
  secp point add <point> [<point>...]       Sum two or more points.
  secp point mul <point> [<scalar>...]      Multiply a point by one or more scalars.

-- Formats --

Points are represented in 65-byte compressed hex format. Example:

  02eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

Scalars are represented in 32-byte hex format. Example:

  e8c23ee3c98e040adea5dc92c5c381d6be93615f289ec2d505909657368a0c8f

Prepending a minus sign '-' in front of a point or scalar will negate it. Example:

  -02eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

-- Special values --

- The values '0', '1', or '-1' may be substituted for any scalar.
- The value 'G' may be substituted for any point to represent the secp256k1 base point.
- The value '0' may be substituted for any point to represent the additive identity point (infinity).

示例用法

s1=`secp scalar gen`
s2=`secp scalar gen`
p1=`secp point mul G $s1`
p2=`secp point mul G $s2`
p3=`secp point add $p1 $p2`
p4=`secp point add $p1 -$p2`