{"record":{"id":"1eec0ff1ca27b8ef","repo":"OpenNHP/opennhp","slug":"invalid-s-value","errorCode":null,"errorMessage":"invalid s value","messagePattern":"invalid s value","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/kgc/user/user.go","lineNumber":213,"sourceCode":"\tif r.Sign() == 0 {\n\t\treturn nil, nil, fmt.Errorf(\"invalid r value\")\n\t}\n\n\t// k⁻¹\n\tkInv := new(big.Int).ModInverse(k, u.Params().N)\n\n\tprk, err := base64.StdEncoding.DecodeString(prkBase64)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\t// s = k⁻¹·(e + r·dA) mod n\n\trda := new(big.Int).Mul(r, new(big.Int).SetBytes(prk))\n\tePlusRda := new(big.Int).Add(rda, new(big.Int).SetBytes(msgHash))\n\ts = new(big.Int).Mod(new(big.Int).Mul(ePlusRda, kInv), u.Params().N)\n\n\tif s.Sign() == 0 {\n\t\treturn nil, nil, fmt.Errorf(\"invalid s value\")\n\t}\n\n\treturn r, s, nil\n}\n\n// Verify checks the validity of an ECDSA signature (r, s) for the given message using the user's public key.\n// It returns true if the signature is valid, false otherwise, and any error encountered during verification.\n// The verification is performed using the standard ECDSA algorithm:\n// 1. Hashes the message to get e (same hash function as used in signing)\n// 2. Checks that r and s are in the range [1, N-1] where N is the curve order\n// 3. Computes w = s⁻¹ mod N\n// 4. Computes u1 = e·w mod N and u2 = r·w mod N\n// 5. Computes (x1, y1) = u1*G + u2*Q where Q is the public key point\n// 6. Verifies that r ≡ x1 mod N\n// If any step fails, the signature is considered invalid.\nfunc (u *UserImpl) Verify(declaredPbkBase64, userId, message, sigBase64 string) bool {\n\tn := u.Params().N\n","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/kgc/user/user.go#L195-L231","documentation":"Raised at the end of Sign: after computing s = k⁻¹·(e + r·dA) mod N the scalar s came out zero. Like a zero r, this is an extremely rare random-nonce edge case that would produce an invalid signature, so the operation aborts. The freshly generated nonce k is the effective input at fault.","triggerScenarios":"Thrown at endpoints/kgc/user/user.go:213 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry Sign with a newly generated nonce k","If it recurs, suspect the random number generator and check the system entropy source"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}