def finish

bend-collections@1.0.0.0 · src/crypto/secp256k1/ecdsa.bend:84

import Base
import bend-collections@1.0.0.0/src/crypto/secp256k1/field.bend as F
import bend-collections@1.0.0.0/src/crypto/secp256k1/scalar.bend as S
import bend-collections@1.0.0.0/src/crypto/secp256k1/bytes.bend as B

84# r = x(R) mod n, s = k^-1 (z + r d) mod n, made low (s > n / 2 is replaced
85# by n - s, which flips the parity bit of the recovery id); the recovery
86# id is the parity of y(R), plus 2 when x(R) >= n
87def finish(+z: List<&2, Nat>, +d: List<&2, Nat>, +k: List<&2, Nat>, +x: List<&2, Nat>, +y: List<&2, Nat>) -> Attempt:
88  +r = S.reduce(x)
89  +s0 = S.mul(S.inv(k), S.add(z, S.mul(r, d)))
90  +high = b2n(S.is_high(s0))
91  +par = F.parity(y)
92  +id = Nat.add(Nat.mul(b2n(Bool.not(S.lt_n(x))), 2n), Nat.sub(Nat.add(par, high), Nat.mul(Nat.mul(par, high), 2n)))
93  finish_if(Bool.or(S.is_zero(r), S.is_zero(s0)), Signature{B.to_be(r), B.to_be(S.select(high, S.neg(s0), s0)), U32.from_nat(id)})