I am talking about this function when I mean GenerateConversationKey:
func GenerateConversationKey(sendPrivkey *secp256k1.PrivateKey, recvPubkey *secp256k1.PublicKey) []byte {
// TODO: Make sure keys are not invalid or weak since the secp256k1 package does not.
// See documentation of secp256k1.PrivKeyFromBytes:
// ================================================================================
// | WARNING: This means passing a slice with more than 32 bytes is truncated and |
// | that truncated value is reduced modulo N. Further, 0 is not a valid private |
// | key. It is up to the caller to provide a value in the appropriate range of |
// | [1, N-1]. Failure to do so will either result in an invalid private key or |
// | potentially weak private keys that have bias that could be exploited. |
// ================================================================================
// -- https://pkg.go.dev/github.com/decred/dcrd/dcrec/secp256k1/v4#PrivKeyFromBytes
shared := secp256k1.GenerateSharedSecret(sendPrivkey, recvPubkey)
return hkdf.Extract(sha256.New, shared, []byte("nip44-v2"))
}
However, since these keys are already of type secp256k1.PrivateKey and secp256k1.PublicKey (to be precise: pointers of these types), these keys could have been generated in a weak way - for example, if the caller used https://pkg.go.dev/github.com/decred/dcrd/dcrec/secp256k1/v4#PrivKeyFromBytes which contains the warning that I copied into my GenerateSharedSecret function:
// | WARNING: This means passing a slice with more than 32 bytes is truncated and |
// | that truncated value is reduced modulo N. Further, 0 is not a valid private |
// | key. It is up to the caller to provide a value in the appropriate range of |
// | [1, N-1]. Failure to do so will either result in an invalid private key or |
// | potentially weak private keys that have bias that could be exploited. |
//
This library does not make sure yet that the secp256k1 keys you want to use for the conversation key are valid, protected against twist attacks and not contain any other weaknesses as mentioned in the NIP-44 security audit.
If you really want to use this library before this is fixed, you need to make sure that the keys you use with GenerateConversationKey are not affected yourself.
Oh, I think I found another source of confusion.
I am talking about this function when I mean
GenerateConversationKey:func GenerateConversationKey(sendPrivkey *secp256k1.PrivateKey, recvPubkey *secp256k1.PublicKey) []byte { // TODO: Make sure keys are not invalid or weak since the secp256k1 package does not. // See documentation of secp256k1.PrivKeyFromBytes: // ================================================================================ // | WARNING: This means passing a slice with more than 32 bytes is truncated and | // | that truncated value is reduced modulo N. Further, 0 is not a valid private | // | key. It is up to the caller to provide a value in the appropriate range of | // | [1, N-1]. Failure to do so will either result in an invalid private key or | // | potentially weak private keys that have bias that could be exploited. | // ================================================================================ // -- https://pkg.go.dev/github.com/decred/dcrd/dcrec/secp256k1/v4#PrivKeyFromBytes shared := secp256k1.GenerateSharedSecret(sendPrivkey, recvPubkey) return hkdf.Extract(sha256.New, shared, []byte("nip44-v2")) }This is part of my NIP-44 golang library. (NIP-44 was recently merged.) So this code is meant to be called with
secp256k1keys (see function signature).However, since these keys are already of type
secp256k1.PrivateKeyandsecp256k1.PublicKey(to be precise: pointers of these types), these keys could have been generated in a weak way - for example, if the caller used https://pkg.go.dev/github.com/decred/dcrd/dcrec/secp256k1/v4#PrivKeyFromBytes which contains the warning that I copied into myGenerateSharedSecretfunction:// | WARNING: This means passing a slice with more than 32 bytes is truncated and | // | that truncated value is reduced modulo N. Further, 0 is not a valid private | // | key. It is up to the caller to provide a value in the appropriate range of | // | [1, N-1]. Failure to do so will either result in an invalid private key or | // | potentially weak private keys that have bias that could be exploited. | //So currently, there is a disclaimer in the README of my NIP-44 implementation since not all test vectors are passing. I am using
PrivKeyFromBytesmyself in my tests and my library is not checking for weak or invalid private keys:See this line in my tests:
func assertConversationKeyFail(t *testing.T, sk1 string, pub2 string, msg string) { // TODO: Update GenerateConversationKey since secp256k1 does accept invalid or weak keys t.Skip("secp256k1 keys are not validated yet during conversation key generation.")