What the developer wrote
Authored by Boris Nagaev
musig2: test partial signature short reads
What changed, and why it matters
This commit only adds a new unit test that checks whether the MuSig2 partial signature decoder correctly rejects empty or too-short inputs. It does not change any production code, so by itself it cannot introduce or fix a security vulnerability. The test may be a regression test for an already-fixed bug, or simply defensive coverage, but the diff provides no evidence of a prior security issue.
No action required for this commit alone. If reviewing a series, check whether an earlier commit changed PartialSignature.Decode and whether this test was added as regression coverage for that change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds TestPartialSignatureDecodeRejectsShortReads in btcec/schnorr/musig2/sign_test.go. It feeds nil and 31-byte inputs to PartialSignature.Decode and asserts that an error is returned. No implementation code is modified. The commit message and diff do not describe any security relevance, CVE, or researcher attribution.
Changed components
btcec/schnorr/musig2/sign_test.goInspect captured patch +21 / −0
diff --git a/btcec/schnorr/musig2/sign_test.go b/btcec/schnorr/musig2/sign_test.go
index a967cfe..1964739 100644
--- a/btcec/schnorr/musig2/sign_test.go
+++ b/btcec/schnorr/musig2/sign_test.go
@@ -311,6 +311,27 @@ func pSigsFromIndices(t *testing.T, sigs []string, indices []int) []*PartialSign
return pSigs
}
+// TestPartialSignatureDecodeRejectsShortReads verifies that Decode rejects
+// inputs that do not contain a full scalar.
+func TestPartialSignatureDecodeRejectsShortReads(t *testing.T) {
+ t.Parallel()
+
+ testCases := map[string][]byte{
+ "empty": nil,
+ "truncated": bytes.Repeat([]byte{0x01}, 31),
+ }
+
+ for name, testCase := range testCases {
+ t.Run(name, func(t *testing.T) {
+ t.Parallel()
+
+ var sig PartialSignature
+ err := sig.Decode(bytes.NewReader(testCase))
+ require.Error(t, err)
+ })
+ }
+}
+
// TestMusig2SignCombine tests that we pass the musig2 sig combination tests.
func TestMusig2SignCombine(t *testing.T) {
t.Parallel()
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.