tests: Add Wycheproof ECDSA vectors

Adds a test using the Wycheproof vectors as outlined in #1106. The
vectors are taken from the Wycheproof repo. We use a python script
to convert the JSON-formatted vectors into C code.

Co-authored-by: Sean Andersen <6730974+andozw@users.noreply.github.com>

Author: RandomLattice

Makefile.am

@@ -247,3 +247,17 @@ endif
 if ENABLE_MODULE_SCHNORRSIG
 include src/modules/schnorrsig/Makefile.am.include
 endif
+
+EXTRA_DIST += src/vectors/ecdsa_secp256k1_sha256_bitcoin_test.inc
+EXTRA_DIST += src/vectors/ecdsa_secp256k1_sha256_bitcoin_test.json
+EXTRA_DIST += src/vectors/tests_wycheproof_generate.py
+
+TESTVECTORS = src/vectors/ecdsa_secp256k1_sha256_bitcoin_test.inc
+
+src/vectors/ecdsa_secp256k1_sha256_bitcoin_test.inc: src/vectors/ecdsa_secp256k1_sha256_bitcoin_test.json
+	python3 src/vectors/tests_wycheproof_generate.py $< > $@
+
+testvectors: $(TESTVECTORS)
+
+clean-testvectors:
+	rm -f $(TESTVECTORS)

ci/cirrus.sh

@@ -109,8 +109,8 @@ fi
 # Rebuild precomputed files (if not cross-compiling).
 if [ -z "$HOST" ]
 then
-    make clean-precomp
-    make precomp
+    make clean-precomp clean-testvectors
+    make precomp testvectors
 fi
 
 # Check that no repo files have been modified by the build.

src/tests.c

@@ -7306,6 +7306,40 @@ static void run_ecdsa_edge_cases(void) {
     test_ecdsa_edge_cases();
 }
 
+/** Wycheproof tests
+
+The tests check for known attacks (range checks in (r,s), arithmetic errors, malleability).
+*/
+static void test_ecdsa_wycheproof(void) {
+    #include "vectors/ecdsa_secp256k1_sha256_bitcoin_test.inc"
+
+    int t;
+    for (t = 0; t < SECP256K1_TEST_ECDSA_WYCHEPROOF_NUMBER_TESTS; t++) {
+        secp256k1_ecdsa_signature signature;
+        secp256k1_sha256 hasher;
+        secp256k1_pubkey pubkey;
+        unsigned char out[32] = {0};
+        int actual_verify = 0;
+
+        memset(&pubkey, 0, sizeof(pubkey));
+        CHECK(secp256k1_ec_pubkey_parse(CTX, &pubkey, testcases[t].pk, 65) == 1);
+
+        secp256k1_sha256_initialize(&hasher);
+        secp256k1_sha256_write(&hasher, (const unsigned char*)testcases[t].msg, testcases[t].msglen);
+        secp256k1_sha256_finalize(&hasher, out);
+
+        if (secp256k1_ecdsa_signature_parse_der(CTX, &signature, testcases[t].sig, testcases[t].siglen) == 1) {
+            actual_verify = secp256k1_ecdsa_verify(CTX, (const secp256k1_ecdsa_signature *)&signature, out, &pubkey);
+        }
+        CHECK(testcases[t].expected_verify == actual_verify);
+    }
+}
+
+/* Tests cases from Wycheproof test suite. */
+static void run_ecdsa_wycheproof(void) {
+    test_ecdsa_wycheproof();
+}
+
 #ifdef ENABLE_MODULE_ECDH
 # include "modules/ecdh/tests_impl.h"
 #endif
@@ -7638,6 +7672,7 @@ int main(int argc, char **argv) {
     run_ecdsa_sign_verify();
     run_ecdsa_end_to_end();
     run_ecdsa_edge_cases();
+    run_ecdsa_wycheproof();
 
 #ifdef ENABLE_MODULE_RECOVERY
     /* ECDSA pubkey recovery tests */