2115cba9c6
e306be7429Use 72 byte dummy signatures when watching only inputs may be used (Andrew Chow)48b1473c89Use 71 byte signature for DUMMY_SIGNATURE_CREATOR (Andrew Chow)18dfea0dd0Always create 70 byte signatures with low R values (Andrew Chow) Pull request description: When creating signatures for transactions, always make one which has a 32 byte or smaller R and 32 byte or smaller S value. This results in signatures that are always less than 71 bytes (32 byte R + 32 byte S + 6 bytes DER + 1 byte sighash) with low R values. In most cases, the signature will be 71 bytes. Because R is not mutable in the same way that S is, a low R value can only be found by trying different nonces. RFC 6979 for deterministic nonce generation has the option to specify additional entropy, so we simply use that and add a uin32_t counter which we increment in order to try different nonces. Nonces are sill deterministically generated as the nonce used will the be the first one where the counter results in a nonce that results in a low R value. Because different nonces need to be tried, time to produce a signature does increase. On average, it takes twice as long to make a signature as two signatures need to be created, on average, to find one with a low R. Having a fixed size signature makes size calculations easier and also saves half a byte of transaction size, on average. DUMMY_SIGNATURE_CREATOR has been modified to produce 71 byte dummy signatures instead of 72 byte signatures. Tree-SHA512: 3cd791505126ce92da7c631856a97ba0b59e87d9c132feff6e0eef1dc47768e81fbb38bfbe970371bedf9714b7f61a13a5fe9f30f962c81734092a4d19a4ef33
110 lines
4 KiB
C++
110 lines
4 KiB
C++
// Copyright (c) 2016-2018 The Bitcoin Core developers
|
|
// Distributed under the MIT software license, see the accompanying
|
|
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
|
|
#include <bench/bench.h>
|
|
#include <key.h>
|
|
#if defined(HAVE_CONSENSUS_LIB)
|
|
#include <script/bitcoinconsensus.h>
|
|
#endif
|
|
#include <script/script.h>
|
|
#include <script/sign.h>
|
|
#include <script/standard.h>
|
|
#include <streams.h>
|
|
|
|
#include <array>
|
|
|
|
// FIXME: Dedup with BuildCreditingTransaction in test/script_tests.cpp.
|
|
static CMutableTransaction BuildCreditingTransaction(const CScript& scriptPubKey)
|
|
{
|
|
CMutableTransaction txCredit;
|
|
txCredit.nVersion = 1;
|
|
txCredit.nLockTime = 0;
|
|
txCredit.vin.resize(1);
|
|
txCredit.vout.resize(1);
|
|
txCredit.vin[0].prevout.SetNull();
|
|
txCredit.vin[0].scriptSig = CScript() << CScriptNum(0) << CScriptNum(0);
|
|
txCredit.vin[0].nSequence = CTxIn::SEQUENCE_FINAL;
|
|
txCredit.vout[0].scriptPubKey = scriptPubKey;
|
|
txCredit.vout[0].nValue = 1;
|
|
|
|
return txCredit;
|
|
}
|
|
|
|
// FIXME: Dedup with BuildSpendingTransaction in test/script_tests.cpp.
|
|
static CMutableTransaction BuildSpendingTransaction(const CScript& scriptSig, const CMutableTransaction& txCredit)
|
|
{
|
|
CMutableTransaction txSpend;
|
|
txSpend.nVersion = 1;
|
|
txSpend.nLockTime = 0;
|
|
txSpend.vin.resize(1);
|
|
txSpend.vout.resize(1);
|
|
txSpend.vin[0].prevout.hash = txCredit.GetHash();
|
|
txSpend.vin[0].prevout.n = 0;
|
|
txSpend.vin[0].scriptSig = scriptSig;
|
|
txSpend.vin[0].nSequence = CTxIn::SEQUENCE_FINAL;
|
|
txSpend.vout[0].scriptPubKey = CScript();
|
|
txSpend.vout[0].nValue = txCredit.vout[0].nValue;
|
|
|
|
return txSpend;
|
|
}
|
|
|
|
// Microbenchmark for verification of a basic P2WPKH script. Can be easily
|
|
// modified to measure performance of other types of scripts.
|
|
static void VerifyScriptBench(benchmark::State& state)
|
|
{
|
|
const int flags = SCRIPT_VERIFY_WITNESS | SCRIPT_VERIFY_P2SH;
|
|
const int witnessversion = 0;
|
|
|
|
// Keypair.
|
|
CKey key;
|
|
static const std::array<unsigned char, 32> vchKey = {
|
|
{
|
|
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1
|
|
}
|
|
};
|
|
key.Set(vchKey.begin(), vchKey.end(), false);
|
|
CPubKey pubkey = key.GetPubKey();
|
|
uint160 pubkeyHash;
|
|
CHash160().Write(pubkey.begin(), pubkey.size()).Finalize(pubkeyHash.begin());
|
|
|
|
// Script.
|
|
CScript scriptPubKey = CScript() << witnessversion << ToByteVector(pubkeyHash);
|
|
CScript scriptSig;
|
|
CScript witScriptPubkey = CScript() << OP_DUP << OP_HASH160 << ToByteVector(pubkeyHash) << OP_EQUALVERIFY << OP_CHECKSIG;
|
|
const CMutableTransaction& txCredit = BuildCreditingTransaction(scriptPubKey);
|
|
CMutableTransaction txSpend = BuildSpendingTransaction(scriptSig, txCredit);
|
|
CScriptWitness& witness = txSpend.vin[0].scriptWitness;
|
|
witness.stack.emplace_back();
|
|
key.Sign(SignatureHash(witScriptPubkey, txSpend, 0, SIGHASH_ALL, txCredit.vout[0].nValue, SigVersion::WITNESS_V0), witness.stack.back());
|
|
witness.stack.back().push_back(static_cast<unsigned char>(SIGHASH_ALL));
|
|
witness.stack.push_back(ToByteVector(pubkey));
|
|
|
|
// Benchmark.
|
|
while (state.KeepRunning()) {
|
|
ScriptError err;
|
|
bool success = VerifyScript(
|
|
txSpend.vin[0].scriptSig,
|
|
txCredit.vout[0].scriptPubKey,
|
|
&txSpend.vin[0].scriptWitness,
|
|
flags,
|
|
MutableTransactionSignatureChecker(&txSpend, 0, txCredit.vout[0].nValue),
|
|
&err);
|
|
assert(err == SCRIPT_ERR_OK);
|
|
assert(success);
|
|
|
|
#if defined(HAVE_CONSENSUS_LIB)
|
|
CDataStream stream(SER_NETWORK, PROTOCOL_VERSION);
|
|
stream << txSpend;
|
|
int csuccess = bitcoinconsensus_verify_script_with_amount(
|
|
txCredit.vout[0].scriptPubKey.data(),
|
|
txCredit.vout[0].scriptPubKey.size(),
|
|
txCredit.vout[0].nValue,
|
|
(const unsigned char*)stream.data(), stream.size(), 0, flags, nullptr);
|
|
assert(csuccess == 1);
|
|
#endif
|
|
}
|
|
}
|
|
|
|
BENCHMARK(VerifyScriptBench, 6300);
|