weierstrass: add helper. secp256k1: simplify schnorr signing.

paulmillr · paulmillr · commit 81f019233d3b · 2025-07-30T01:36:14.000Z
diff --git a/src/abstract/weierstrass.ts b/src/abstract/weierstrass.ts
@@ -1336,6 +1336,12 @@ export function ecdsa(
       throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
     return num;
   }
+  function validateSigLength(bytes: Uint8Array, format: ECDSASigFormat) {
+    validateSigFormat(format);
+    const size = lengths.signature!;
+    const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;
+    return abytes(bytes, sizer, `${format} signature`);
+  }
 
   /**
    * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.
@@ -1352,22 +1358,18 @@ export function ecdsa(
     }
 
     static fromBytes(bytes: Uint8Array, format: ECDSASigFormat = defaultSigOpts_format): Signature {
-      validateSigFormat(format);
-      const size = lengths.signature!;
+      validateSigLength(bytes, format)
       let recid: number | undefined;
       if (format === 'der') {
         const { r, s } = DER.toSig(abytes(bytes));
         return new Signature(r, s);
       }
       if (format === 'recovered') {
-        abytes(bytes, size + 1);
         recid = bytes[0];
-
         format = 'compact';
         bytes = bytes.subarray(1);
       }
-      abytes(bytes, size);
-      const L = size / 2;
+      const L = Fn.BYTES;
       const r = bytes.subarray(0, L);
       const s = bytes.subarray(L, L * 2);
       return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
diff --git a/src/secp256k1.ts b/src/secp256k1.ts
@@ -179,9 +179,8 @@ function schnorrSign(message: Hex, secretKey: PrivKey, auxRand: Hex = randomByte
   const a = ensureBytes('auxRand', auxRand, 32); // Auxiliary random data a: a 32-byte array
   const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)
   const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)
-  const k_ = Fn.create(num(rand)); // Let k' = int(rand) mod n
-  if (k_ === _0n) throw new Error('sign failed: k is zero'); // Fail if k' = 0.
-  const { bytes: rx, scalar: k } = schnorrGetExtPubKey(k_); // Let R = k'⋅G.
+  // Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G
+  const { bytes: rx, scalar: k } = schnorrGetExtPubKey(rand);
   const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.
   const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).
   sig.set(rx, 0);
