ecdsa: proper recovery param for canonical sigs

Fix: #59
2026-09-23 23:51:03 +00:00 · 2015-11-02 16:05:57 -05:00
parent f5bd12fa53
commit 1a05d7c67a
1 changed files with 6 additions and 4 deletions
@@ -134,13 +134,15 @@ EC.prototype.sign = function sign(msg, key, enc, options) {
    if (s.cmpn(0) === 0)
      continue;

-    // Use complement of `s`, if it is > `n / 2`
-    if (options.canonical && s.cmp(this.nh) > 0)
-      s = this.n.sub(s);
-
    var recoveryParam = (kp.getY().isOdd() ? 1 : 0) |
                        (kpX.cmp(r) !== 0 ? 2 : 0);

+    // Use complement of `s`, if it is > `n / 2`
+    if (options.canonical && s.cmp(this.nh) > 0) {
+      s = this.n.sub(s);
+      recoveryParam ^= 1;
+    }
+
    return new Signature({ r: r, s: s, recoveryParam: recoveryParam });
  } while (true);
 };