Fix input overflow handling during negation

Author: kripod

lib/elliptic/index.js

@@ -74,7 +74,7 @@ exports.privateKeyExport = function (privateKey, compressed) {
 
 exports.privateKeyNegate = function (privateKey) {
   var bn = new BN(privateKey)
-  return bn.isZero() ? Buffer.alloc(32) : ecparams.n.sub(bn).toArrayLike(Buffer, 'be', 32)
+  return bn.isZero() ? Buffer.alloc(32) : ecparams.n.sub(bn).umod(ecparams.n).toArrayLike(Buffer, 'be', 32)
 }
 
 exports.privateKeyModInverse = function (privateKey) {

lib/js/index.js

@@ -21,7 +21,18 @@ exports.privateKeyExport = function (privateKey, compressed) {
 
 exports.privateKeyNegate = function (privateKey) {
   var bn = BN.fromBuffer(privateKey)
-  return bn.isZero() ? Buffer.alloc(32) : BN.n.sub(bn).toBuffer()
+
+  if (bn.isZero()) {
+    return Buffer.alloc(32)
+  }
+
+  if (bn.ucmp(BN.n) !== 0) {
+    while (bn.isOverflow()) {
+      bn.isub(BN.n)
+    }
+  }
+
+  return BN.n.sub(bn).toBuffer()
 }
 
 exports.privateKeyModInverse = function (privateKey) {

test/privatekey.js

@@ -149,6 +149,16 @@ module.exports = function (t, secp256k1) {
       t.end()
     })
 
+    t.test('private key overflow', function (t) {
+      var privateKey = util.ec.curve.n.addn(10).toArrayLike(Buffer, 'be', 32)
+
+      var expected = util.ec.curve.n.subn(10).toArrayLike(Buffer, 'be', 32)
+      var result = secp256k1.privateKeyNegate(privateKey)
+      t.same(result, expected)
+
+      t.end()
+    })
+
     util.repeat(t, 'random tests', util.env.repeat, function (t) {
       var privateKey = util.getPrivateKey()