verify static method

bool verify(Uint8List signature, Uint8List messageHash, Uint8List publicKey)

Verifies a BIP-340 Schnorr signature.

signature must be 64 bytes (r || s). messageHash must be 32 bytes. publicKey must be 32 bytes (x-only public key).

Implementation

static bool verify(
    Uint8List signature, Uint8List messageHash, Uint8List publicKey) {
  if (signature.length != 64) return false;
  if (messageHash.length != 32) return false;
  if (publicKey.length != 32) return false;

  try {
    // 1. Parse signature
    final r = _bytesToBigInt(signature.sublist(0, 32));
    final s = _bytesToBigInt(signature.sublist(32, 64));

    if (r >= _p || s >= _n) return false;

    // 2. Lift x coordinate to point P
    final P = _liftX(publicKey);
    if (P == null) return false;

    // 3. Compute e = tagged_hash("BIP0340/challenge", r || P || m) mod n
    final eHash = _taggedHash(
      'BIP0340/challenge',
      Uint8List.fromList(
          [...signature.sublist(0, 32), ...publicKey, ...messageHash]),
    );
    final e = _bytesToBigInt(eHash) % _n;

    // 4. Compute R' = s * G - e * P
    final sG = _scalarMult(s, [_Gx, _Gy]);
    final eP = _scalarMult(e, P);
    final ePNeg = [eP[0], _p - eP[1]]; // Negate y
    final R = _pointAdd(sG, ePNeg);

    // 5. Verify R' is not at infinity
    if (R[0] == BigInt.zero && R[1] == BigInt.zero) return false;

    // 6. Verify R'.y is even
    if (_hasOddY(R)) return false;

    // 7. Verify R'.x == r
    return R[0] == r;
  } on Exception catch (_) {
    return false;
  }
}