def finish

bend-collections-laws-crypto@1.0.0.0 · spec/crypto/secp256k1/ecdsa.bend:95

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/field.bend as FS
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/curve.bend as CV

95# R = (x, y) = [k] G, r = x mod n, s = k^-1 (e + r d) mod n; r = 0 or
96# s = 0 means another k. s > n / 2 (n is odd: n < 2 s) becomes n - s. The
97# recovery id is (y mod 2) + 2 (x >= n), with its low bit flipped when s was
98# replaced.
99def finish(+one: Nat, +e: Nat, +d: Nat, +k: Nat, a: CV.SAffine) -> Attempt:
100  match a:
101    case CV.SAffine{+x, +y}:
102      +m = n(one)
103      +r = Nat.mod(x, m)
104      +s = FS.mmul(m, FS.minv(m, k), FS.madd(m, e, FS.mmul(m, r, d)))
105      +high = Nat.is_lt(m, Nat.double(s))
106      finish_if(Bool.or(Nat.is_eq(r, 0n), Nat.is_eq(s, 0n)), cat(i2osp32(r), cat(i2osp32(low(high, m, s)), [U32.from_nat(Nat.add(ge2(Nat.is_lt(x, m)), flip(high, Nat.mod(y, 2n))))])))