Repository navigation
DLEQ follows BIP374 0.3.0: reduce the challenge, refuse e >= n (closes #149) - #153
Conversation
Documentation build overview
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed 7a11cbf. This job ran no gates; the workflows on this sha are what stands. Neither the pull request nor the commit says what the author ran.
No findings. The change does everything #149 asks, including the correction in its comments that limits this pull request to the code. Both new tests fail without the change. On main, an e of n or more fails with "invalid challenge", not "e not in 0..n-1". An unreduced challenge would put n + 5, not 5, in the generated proof. Verification uses only public values, and no computation moves between the bindings and the Python arithmetic.
Not checked: BIP374 0.3.0 and its reference.py were not opened from bitcoin/bips. The e >= GE.ORDER line cited in _assert_structurally_valid_ was checked against #149's account of the reference, not the reference itself.
Not about this pull request (a wording note, not filed): tests/_data/README.md:590-592 says s >= n has no vector in either BIP374 file. Rows 17 and 18 of test_vectors_verify_proof.csv are the e = n and s = n cases, and the new docstring at tests/ecc/dleq_test.py:154 says so correctly.
ACK 7a11cbf
7a11cbf to
3bf8c0a
Compare
…#149) The challenge hash is reduced modulo n and verification refuses an e of n or more, as BIP374 0.3.0 says (bips#2262). The tests make both observable: a verify with e = n, n + 1 and 2^256 - 1, and a challenge hash forced above n. Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>
3bf8c0a to
9ac8928
Compare
DLEQ proofs now follow BIP374 0.3.0. The challenge is the tagged hash reduced modulo n, and a proof with e >= n is refused with its own error, as the BIP's reference does since bitcoin/bips#2262.
The answer changes only for an honest 0.2.0 proof whose hash is n or more, about once in 2^128. A forged e >= n was already refused, by the challenge comparison. The new tests force the challenge hash above n, and try e = n, n + 1 and the largest 32-byte value.
Closes #149
🤖 Generated with Claude Code
Made with my usual tools: a computer, the Internet and an LLM. The mistakes, as usual, are all mine.