-module(aws@internal@ecdsa_deterministic).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/aws/internal/ecdsa_deterministic.gleam").
-export([sign_p256/2, sign_p256_rs_hex/2]).
-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.
?MODULEDOC(
" RFC 6979 deterministic ECDSA over NIST P-256 with SHA-256.\n"
"\n"
" The standard ECDSA algorithm picks a fresh random nonce `k` per\n"
" signature; the signature varies between two signings of the\n"
" same `(key, message)`. Erlang's `crypto:sign/4` follows that\n"
" model — signatures are valid (server-side verify works) but\n"
" not byte-reproducible. RFC 6979 derives `k` deterministically\n"
" from `(d, h1)` via HMAC-DRBG, making signatures byte-for-byte\n"
" reproducible against the reference vectors in §A.2.5 and\n"
" against the aws-c-auth v4a corpus.\n"
"\n"
" **Architecture.** The HMAC-DRBG nonce derivation, modular\n"
" arithmetic, and DER encoding are pure Gleam. The one expensive\n"
" step — the elliptic-curve point multiplication `k·G` — is\n"
" outsourced to Erlang's `crypto:generate_key(ecdh, secp256r1, k)`\n"
" via the existing `aws_ffi:ecdsa_p256_public_key/1` FFI. That\n"
" gives us the X coordinate of `k·G` from which the `r` half of\n"
" the signature is `X mod q`. Computing `s` and DER-encoding the\n"
" `(r, s)` pair is then pure integer arithmetic, which BEAM\n"
" bignums handle natively.\n"
).
-file("src/aws/internal/ecdsa_deterministic.gleam", 222).
-spec high_bit_set(bitstring()) -> boolean().
high_bit_set(B) ->
case B of
<<First:8, _/bitstring>> ->
First >= 16#80;
_ ->
false
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 211).
-spec strip_leading_zeros(bitstring()) -> bitstring().
strip_leading_zeros(B) ->
case B of
<<0:8, Rest/bitstring>> ->
case erlang:byte_size(Rest) > 0 of
true ->
strip_leading_zeros(Rest);
false ->
B
end;
_ ->
B
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 202).
?DOC(
" DER `INTEGER`: `0x02 LL <bytes>`. Bytes are the minimum-length\n"
" big-endian magnitude of `n` with a 0x00 prefix when the high bit\n"
" of the magnitude is set (so it reads as unsigned).\n"
).
-spec der_int_bytes(integer()) -> bitstring().
der_int_bytes(N) ->
Raw = strip_leading_zeros(<<N:256/big>>),
Prefixed = case high_bit_set(Raw) of
true ->
<<0:8, Raw/bitstring>>;
false ->
Raw
end,
<<16#02, ((erlang:byte_size(Prefixed))):8, Prefixed/bitstring>>.
-file("src/aws/internal/ecdsa_deterministic.gleam", 192).
-spec der_encode_sig(integer(), integer()) -> bitstring().
der_encode_sig(R, S) ->
R_int = der_int_bytes(R),
S_int = der_int_bytes(S),
Inner_len = erlang:byte_size(R_int) + erlang:byte_size(S_int),
<<16#30, Inner_len:8, R_int/bitstring, S_int/bitstring>>.
-file("src/aws/internal/ecdsa_deterministic.gleam", 164).
-spec mod_mul(integer(), integer(), integer()) -> integer().
mod_mul(A, B, M) ->
case M of
0 -> 0;
Gleam@denominator -> A * B rem Gleam@denominator
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 160).
-spec mod_add(integer(), integer(), integer()) -> integer().
mod_add(A, B, M) ->
case M of
0 -> 0;
Gleam@denominator -> (A + B) rem Gleam@denominator
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 180).
-spec ext_gcd(integer(), integer()) -> {integer(), integer(), integer()}.
ext_gcd(A, B) ->
case B of
0 ->
{A, 1, 0};
_ ->
{G, X1, Y1} = ext_gcd(B, case B of
0 -> 0;
Gleam@denominator -> A rem Gleam@denominator
end),
{G, Y1, X1 - ((case B of
0 -> 0;
Gleam@denominator@1 -> A div Gleam@denominator@1
end) * Y1)}
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 171).
?DOC(
" Modular inverse via the extended Euclidean algorithm. Caller\n"
" guarantees `gcd(a, m) == 1` — P-256's order is prime so any\n"
" `a ∈ [1, q-1]` is coprime to `q`.\n"
).
-spec mod_inverse(integer(), integer()) -> integer().
mod_inverse(A, M) ->
{_, X, _} = ext_gcd(A, M),
Result = case M of
0 -> 0;
Gleam@denominator -> X rem Gleam@denominator
end,
case Result < 0 of
true ->
Result + M;
false ->
Result
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 246).
?DOC(
" Bit-pattern `<<k:size(256)-big-unsigned>>` always produces 32\n"
" bytes regardless of `k`'s magnitude. Provided as a function for\n"
" signature clarity / future-proofing if we need to accept\n"
" shorter inputs.\n"
).
-spec pad_to_32(bitstring()) -> bitstring().
pad_to_32(B) ->
B.
-file("src/aws/internal/ecdsa_deterministic.gleam", 139).
-spec nonce_loop(bitstring(), bitstring(), integer()) -> {bitstring(),
integer()}.
nonce_loop(K, V, Skip) ->
V_new = aws_ffi:hmac_sha256(K, V),
Candidate@1 = case V_new of
<<Candidate:256/big-unsigned>> -> Candidate;
_assert_fail ->
erlang:error(#{gleam_error => let_assert,
message => <<"Pattern match failed, no pattern matched the value."/utf8>>,
file => <<?FILEPATH/utf8>>,
module => <<"aws/internal/ecdsa_deterministic"/utf8>>,
function => <<"nonce_loop"/utf8>>,
line => 141,
value => _assert_fail,
start => 5392,
'end' => 5447,
pattern_start => 5403,
pattern_end => 5439})
end,
case ((Candidate@1 >= 1) andalso (Candidate@1 < 16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551))
andalso (Skip =:= 0) of
true ->
{V_new, Candidate@1};
false ->
K_next = aws_ffi:hmac_sha256(K, <<V_new/bitstring, 0:8>>),
V_next = aws_ffi:hmac_sha256(K_next, V_new),
Next_skip = case (Candidate@1 >= 1) andalso (Candidate@1 < 16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551) of
true ->
Skip - 1;
false ->
Skip
end,
nonce_loop(K_next, V_next, Next_skip)
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 235).
-spec do_repeat(integer(), integer(), bitstring()) -> bitstring().
do_repeat(Byte, Remaining, Acc) ->
case Remaining of
0 ->
Acc;
_ ->
do_repeat(Byte, Remaining - 1, <<Acc/bitstring, Byte:8>>)
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 231).
-spec repeat_byte(integer(), integer()) -> bitstring().
repeat_byte(Byte, Count) ->
do_repeat(Byte, Count, <<>>).
-file("src/aws/internal/ecdsa_deterministic.gleam", 109).
?DOC(
" HMAC-DRBG nonce derivation per RFC 6979 §3.2. Returns the\n"
" nonce both as a 32-byte big-endian bit array (for the\n"
" EC point-multiplication FFI) and as an integer (for the\n"
" `(r, s)` computation). `attempt` only matters when the outer\n"
" retry loop fires; for the typical `attempt = 0` path it returns\n"
" the canonical nonce.\n"
).
-spec derive_nonce(bitstring(), bitstring(), integer()) -> {bitstring(),
integer()}.
derive_nonce(D_bytes, H1, Attempt) ->
H1_int@1 = case H1 of
<<H1_int:256/big-unsigned>> -> H1_int;
_assert_fail ->
erlang:error(#{gleam_error => let_assert,
message => <<"Pattern match failed, no pattern matched the value."/utf8>>,
file => <<?FILEPATH/utf8>>,
module => <<"aws/internal/ecdsa_deterministic"/utf8>>,
function => <<"derive_nonce"/utf8>>,
line => 114,
value => _assert_fail,
start => 4544,
'end' => 4593,
pattern_start => 4555,
pattern_end => 4588})
end,
H1_mod_q = case 16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 of
0 -> 0;
Gleam@denominator -> H1_int@1 rem Gleam@denominator
end,
Bits2octets_h1 = <<H1_mod_q:256/big>>,
V0 = repeat_byte(16#01, 32),
K0 = repeat_byte(16#00, 32),
K1 = aws_ffi:hmac_sha256(
K0,
<<V0/bitstring, 0:8, D_bytes/bitstring, Bits2octets_h1/bitstring>>
),
V1 = aws_ffi:hmac_sha256(K1, V0),
K2 = aws_ffi:hmac_sha256(
K1,
<<V1/bitstring, 1:8, D_bytes/bitstring, Bits2octets_h1/bitstring>>
),
V2 = aws_ffi:hmac_sha256(K2, V1),
nonce_loop(K2, V2, Attempt).
-file("src/aws/internal/ecdsa_deterministic.gleam", 62).
?DOC(
" RFC 6979's outer retry loop: if `r == 0` or `s == 0` (both\n"
" statistically impossible — ~2^-256 each — but the spec mandates\n"
" the retry), pull a fresh `k` from the HMAC-DRBG and try again.\n"
" The `attempt` arg threads into the nonce derivation so successive\n"
" tries don't keep producing the same `k`.\n"
).
-spec sign_retry_loop(bitstring(), bitstring(), integer(), integer(), integer()) -> {integer(),
integer()}.
sign_retry_loop(Private_key, Message_hash, D, E, Attempt) ->
case Attempt > 100 of
true ->
erlang:error(#{gleam_error => panic,
message => <<"RFC 6979 sign: exceeded 100 nonce-retry attempts"/utf8>>,
file => <<?FILEPATH/utf8>>,
module => <<"aws/internal/ecdsa_deterministic"/utf8>>,
function => <<"sign_retry_loop"/utf8>>,
line => 72});
false ->
{_, K} = derive_nonce(Private_key, Message_hash, Attempt),
K_padded = pad_to_32(<<K:256/big>>),
Pubkey = aws_ffi:ecdsa_p256_public_key(K_padded),
X_r@1 = case Pubkey of
<<_:8, X_r:256/big-unsigned, _:256>> -> X_r;
_assert_fail ->
erlang:error(#{gleam_error => let_assert,
message => <<"Pattern match failed, no pattern matched the value."/utf8>>,
file => <<?FILEPATH/utf8>>,
module => <<"aws/internal/ecdsa_deterministic"/utf8>>,
function => <<"sign_retry_loop"/utf8>>,
line => 80,
value => _assert_fail,
start => 3492,
'end' => 3554,
pattern_start => 3503,
pattern_end => 3545})
end,
R = case 16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 of
0 -> 0;
Gleam@denominator -> X_r@1 rem Gleam@denominator
end,
case R =:= 0 of
true ->
sign_retry_loop(
Private_key,
Message_hash,
D,
E,
Attempt + 1
);
false ->
K_inv = mod_inverse(
K,
16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551
),
S = mod_mul(
K_inv,
mod_add(
E,
mod_mul(
R,
D,
16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551
),
16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551
),
16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551
),
case S =:= 0 of
true ->
sign_retry_loop(
Private_key,
Message_hash,
D,
E,
Attempt + 1
);
false ->
{R, S}
end
end
end.
-file("src/aws/internal/ecdsa_deterministic.gleam", 50).
-spec sign_p256_rs(bitstring(), bitstring()) -> {integer(), integer()}.
sign_p256_rs(Private_key, Message_hash) ->
D@1 = case Private_key of
<<D:256/big-unsigned>> -> D;
_assert_fail ->
erlang:error(#{gleam_error => let_assert,
message => <<"Pattern match failed, no pattern matched the value."/utf8>>,
file => <<?FILEPATH/utf8>>,
module => <<"aws/internal/ecdsa_deterministic"/utf8>>,
function => <<"sign_p256_rs"/utf8>>,
line => 51,
value => _assert_fail,
start => 2316,
'end' => 2369,
pattern_start => 2327,
pattern_end => 2355})
end,
E@1 = case Message_hash of
<<E:256/big-unsigned>> -> E;
_assert_fail@1 ->
erlang:error(#{gleam_error => let_assert,
message => <<"Pattern match failed, no pattern matched the value."/utf8>>,
file => <<?FILEPATH/utf8>>,
module => <<"aws/internal/ecdsa_deterministic"/utf8>>,
function => <<"sign_p256_rs"/utf8>>,
line => 52,
value => _assert_fail@1,
start => 2372,
'end' => 2426,
pattern_start => 2383,
pattern_end => 2411})
end,
E_mod_q = case 16#ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 of
0 -> 0;
Gleam@denominator -> E@1 rem Gleam@denominator
end,
sign_retry_loop(Private_key, Message_hash, D@1, E_mod_q, 0).
-file("src/aws/internal/ecdsa_deterministic.gleam", 33).
?DOC(
" Sign a 32-byte SHA-256 hash with a 32-byte P-256 private scalar.\n"
" Returns the DER-encoded `(r, s)` blob — the same shape Erlang's\n"
" `crypto:sign/4` returns for `ecdsa`, so callers can swap the two\n"
" without touching downstream code.\n"
).
-spec sign_p256(bitstring(), bitstring()) -> bitstring().
sign_p256(Private_key, Message_hash) ->
{R, S} = sign_p256_rs(Private_key, Message_hash),
der_encode_sig(R, S).
-file("src/aws/internal/ecdsa_deterministic.gleam", 250).
-spec int_to_hex_256(integer()) -> binary().
int_to_hex_256(N) ->
aws_ffi:hex_encode(<<N:256/big>>).
-file("src/aws/internal/ecdsa_deterministic.gleam", 42).
?DOC(
" Same signature as `sign_p256` but returns `(r_hex, s_hex)` as\n"
" 64-character lowercase strings. Test-side helper for matching\n"
" against the RFC 6979 reference vectors which list `r` / `s` as\n"
" hex.\n"
).
-spec sign_p256_rs_hex(bitstring(), bitstring()) -> {binary(), binary()}.
sign_p256_rs_hex(Private_key, Message_hash) ->
{R, S} = sign_p256_rs(Private_key, Message_hash),
{int_to_hex_256(R), int_to_hex_256(S)}.