ecdsa: low-S normalization support

ecdsa/src/lib.rs

@@ -62,7 +62,7 @@ use core::{
     fmt::{self, Debug},
     ops::Add,
 };
-use elliptic_curve::ElementBytes;
+use elliptic_curve::{Arithmetic, ElementBytes, FromBytes};
 use generic_array::{typenum::Unsigned, ArrayLength, GenericArray};
 
 /// Size of a fixed sized signature for the given elliptic curve.
@@ -139,6 +139,32 @@ where
     }
 }
 
+impl<C> Signature<C>
+where
+    C: Curve + Arithmetic,
+    C::Scalar: NormalizeLow<C>,
+    SignatureSize<C>: ArrayLength<u8>,
+{
+    /// Normalize signature into "low S" form as described in
+    /// [BIP 0062: Dealing with Malleability][1].
+    ///
+    /// [1]: https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki
+    pub fn normalize_s(&mut self) -> Result<(), Error> {
+        let s_bytes = GenericArray::from_mut_slice(&mut self.bytes[C::ElementSize::to_usize()..]);
+        let s_option = C::Scalar::from_bytes(s_bytes);
+
+        // Not constant time, but we're operating on public values
+        if s_option.is_some().into() {
+            let mut s = s_option.unwrap();
+            s.normalize_low();
+            s_bytes.copy_from_slice(&s.into());
+            Ok(())
+        } else {
+            Err(Error::new())
+        }
+    }
+}
+
 impl<C: Curve> signature::Signature for Signature<C>
 where
     SignatureSize<C>: ArrayLength<u8>,
@@ -206,3 +232,13 @@ where
         Signature { bytes }
     }
 }
+
+/// Normalize a scalar (i.e. ECDSA S) to the lower half the field, as described
+/// in [BIP 0062: Dealing with Malleability][1].
+///
+/// [1]: https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki
+pub trait NormalizeLow<C: Curve> {
+    /// Normalize scalar to the lower half of the field (i.e. negate it if it's
+    /// larger than half the curve's order)
+    fn normalize_low(&mut self);
+}