feat: ECDSA error types

internal/generator/ecdsa/template/ecdsa.go.tmpl

@@ -30,6 +30,15 @@ const (
  sizeSignature = 2 * sizeFr
 )
 
+{{- if or (eq .Name "secp256k1") (eq .Name "bn254") (eq .Name "stark-curve") }}
+var (
+ // ErrNoSqrtR is returned when x^3+ax+b is not a square in the field. This
+ // is used for public key recovery and allows to detect if the signature is
+ // valid or not.
+ ErrNoSqrtR = errors.New("x^3+ax+b is not a square in the field")
+)
+{{- end }}
+
 var order = fr.Modulus()
 
 // PublicKey represents an ECDSA public key
@@ -103,10 +112,10 @@ func HashToInt(hash []byte) *big.Int {
 }
 
 {{- if or (eq .Name "secp256k1") (eq .Name "bn254") (eq .Name "stark-curve") }}
-// RecoverP recovers the value P (prover commitment) when creating a signature.
+// recoverP recovers the value P (prover commitment) when creating a signature.
 // It uses the recovery information v and part of the decomposed signature r. It
 // is used internally for recovering the public key.
-func RecoverP(v uint, r *big.Int) (*{{ .CurvePackage }}.G1Affine, error) {
+func recoverP(v uint, r *big.Int) (*{{ .CurvePackage }}.G1Affine, error) {
  if r.Cmp(fr.Modulus()) >= 0 {
  return nil, errors.New("r is larger than modulus")
  }
@@ -135,7 +144,8 @@ func RecoverP(v uint, r *big.Int) (*{{ .CurvePackage }}.G1Affine, error) {
  y.Mod(y, fp.Modulus())
  // y = sqrt(y^2)
  if y.ModSqrt(y, fp.Modulus()) == nil {
- return nil, errors.New("no square root")
+ // there is no square root, return error constant
+ return nil, ErrNoSqrtR
  }
  // check that y has same oddity as defined by v
  if y.Bit(0) != yChoice {

internal/generator/ecdsa/template/marshal.go.tmpl

@@ -62,7 +62,7 @@ func (pk *PublicKey) RecoverFrom(msg []byte, v uint, r, s *big.Int) error {
  if s.Cmp(big.NewInt(0)) <= 0 {
  return errors.New("s is negative")
  }
- P, err := RecoverP(v, r)
+ P, err := recoverP(v, r)
  if err != nil {
  return err
  }