-1

我在 ARM 微控制器 (Ambiq) 上使用 mbedtls 库 ( https://github.com/ARMmbed/mbedtls )。

我需要使用函数 mbedtls_ecdsa_sign_det() 来签署比特币交易。

实际上，我不确定这是否是正确的功能。

这是函数的文档：

Compute ECDSA signature of a previously hashed message, deterministic version (RFC 6979).

Parameters:
grp ECP group
r   First output integer
s   Second output integer
d   Private signing key
buf Message hash
blen    Length of buf
md_alg  MD algorithm used to hash the message
Returns:
0 if successful, or a MBEDTLS_ERR_ECP_XXX or MBEDTLS_MPI_XXX error code

The header file includes the following description:
/**
 * \brief           This function computes the ECDSA signature of a
 *                  previously-hashed message, deterministic version.
 *
 *                  For more information, see <em>RFC-6979: Deterministic
 *                  Usage of the Digital Signature Algorithm (DSA) and Elliptic
 *                  Curve Digital Signature Algorithm (ECDSA)</em>.
 *
 * \note            If the bitlength of the message hash is larger than the
 *                  bitlength of the group order, then the hash is truncated as
 *                  defined in <em>Standards for Efficient Cryptography Group
 *                  (SECG): SEC1 Elliptic Curve Cryptography</em>, section
 *                  4.1.3, step 5.
 *
 * \see             ecp.h
 *
 * \param grp       The context for the elliptic curve to use.
 *                  This must be initialized and have group parameters
 *                  set, for example through mbedtls_ecp_group_load().
 * \param r         The MPI context in which to store the first part
 *                  the signature. This must be initialized.
 * \param s         The MPI context in which to store the second part
 *                  the signature. This must be initialized.
 * \param d         The private signing key. This must be initialized
 *                  and setup, for example through mbedtls_ecp_gen_privkey().
 * \param buf       The hashed content to be signed. This must be a readable
 *                  buffer of length \p blen Bytes. It may be \c NULL if
 *                  \p blen is zero.
 * \param blen      The length of \p buf in Bytes.
 * \param md_alg    The hash algorithm used to hash the original data.
 *
 * \return          \c 0 on success.
 * \return          An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
 *                  error code on failure.
 */
int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r,
                            mbedtls_mpi *s, const mbedtls_mpi *d,
                            const unsigned char *buf, size_t blen,
                            mbedtls_md_type_t md_alg );

此外，我没有找到任何如何使用此功能的示例。

我不知道如何初始化传递的指针，grp、r、s 和 d。

4

1 回答 1

2

从数学上讲，ECDSA 签名是一对两个整数（r，s）。该函数mbedtls_ecdsa_sign_det为您提供两个整数r并s作为输出，由您决定如何输出这些整数。ECDSA 签名有两种常见的表示形式：采用r和s的固定大小表示并将这两者放在一起，或者将它们组装成ASN.1序列，通常采用DER形式（ASN.1 允许多种表示形式，例如使用或没有前导零，并且 DER 是特定的 ASN.1 表示，没有前导零）。比特币使用 DER 表示. 幸运的是，Mbed TLS 有一个函数可以直接输出这个 DER 表示：mbedtls_ecdsa_write_signature.

ECDSA 有两种变体：随机的和确定的。它们无论如何都会产生兼容的签名（确定性变体使用随机参数的特定选择）。mbedtls_ecdsa_write_signature如果您的构建支持它，则使用确定性变体，否则使用随机变体。

下面是调用这个函数的样子。它接受以下输入：

unsigned char signature[2 * 32 + 9]; // "at least twice as large as the size of the curve used, plus 9"
size_t signature_length;
ret = mbedtls_ecdsa_write_signature(key, MBEDTLS_MD_SHA256, hash, 32,
                                    signature, &signature_length,
                                    mbedtls_ctr_drbg_random, &ctr_drbg);
if (ret == 0) {
    // The signature is in the signature array. It is signature_length bytes long. 
} else ERROR();
于 2018-12-25T20:48:02.810 回答