crypto/elliptic: handle compressed formats in new MarshalCompressed, UnmarshalCompressed

[roman-khimov]

What version of Go are you using (go version)?

$ go version
go version go1.12.9 linux/amd64

Does this issue reproduce with the latest release?

I think so.

What operating system and processor architecture are you using (go env)?

play.golang.org

What did you do?

https://play.golang.org/p/ugkQeobnYRP

What did you expect to see?

Successful unmarshaling.

What did you see instead?

Failed unmarshaling.

The real problem

elliptic.Unmarshal() only supports uncompressed format (prefix 0x04) at the moment, as can be seen in the source code, which probably is fine given that it's supposed to be a companion for elliptic.Marshal() that only uses that format to serialize the point. But at the same time it would be very nice to have support for compressed (prefixes 0x02 and 0x03) format that is being used in the wild, it doesn't cost much in terms of code (there is a nice snippet on SO) and this proposed change is certainly backwards-compatible. At the moment I see this (or similar) code being duplicated by several projects that use compressed format, thus this issue.

Of course it would be very nice if elliptic could also serialize into this format, but that's a bit more complicated, because you can't change Marshal() without breaking backwards compatibility (the only option I see at the moment is introducing another function like MarshalCompressed()).

[katiehockman]

/cc @FiloSottile

[gopherbot]

Change https://golang.org/cl/202819 mentions this issue: crypto/elliptic: implement unmarshal for compressed format

[FiloSottile]

Can you provide some examples of projects that had to implement this? If it's indeed common, I'd support implementing it.

[im-kulikov]

Can you provide some examples of projects that had to implement this? If it's indeed common, I'd support implementing it.

• https://github.com/nspcc-dev/neo-go
• https://github.com/nspcc-dev/neofs-crypto
• https://github.com/btcsuite/btcd
• https://github.com/moncho/warpwallet
• etc

[katiehockman]

Supporting compressed formats in elliptic.Unmarshal() would break the backwards compatibility rule, since the docs say

It is an error if the point is not in uncompressed form or is not on the curve.

In order to support this, we could add two new functions to the elliptic package:

func MarshalCompressed(curve Curve, x, y *big.Int) []byte
func UnmarshalCompressed(curve Curve, data []byte) (x, y *big.Int)

[rsc]

Adding to proposal minutes, seems headed for likely accept.

[im-kulikov]

@katiehockman PR updated

MarshalCompressed implemented as specified in section 4.3.6 (2. compressed form) of ANSI X9.62

[rsc]

Based on the discussion above and the specific retitling of adding new functions instead of overloading the existing ones, this seems like a likely accept.

[rsc]

No change in consensus, so accepted.