{"record":{"id":"1f7c7ffa66944473","repo":"OpenNHP/opennhp","slug":"invalid-r-value","errorCode":null,"errorMessage":"invalid r value","messagePattern":"invalid r value","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/kgc/user/user.go","lineNumber":196,"sourceCode":"// 4. Computes s = k⁻¹·(e + r·dA) mod N\n// where e is the message hash, dA is the private key, and N is the curve order.\nfunc (u *UserImpl) Sign(prkBase64 string, message string) (r, s *big.Int, err error) {\n\tu.h.Write([]byte(message))\n\tmsgHash := u.h.Sum(nil)\n\tu.h.Reset()\n\n\tk, err := kgc.GenerateRandomNumber(u.Params().N)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\t// k*G\n\tkGx, _ := u.Curve.ScalarBaseMult(k.Bytes())\n\n\t// r = kGx mod N\n\tr = new(big.Int).Mod(kGx, u.Params().N)\n\tif r.Sign() == 0 {\n\t\treturn nil, nil, fmt.Errorf(\"invalid r value\")\n\t}\n\n\t// k⁻¹\n\tkInv := new(big.Int).ModInverse(k, u.Params().N)\n\n\tprk, err := base64.StdEncoding.DecodeString(prkBase64)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\t// s = k⁻¹·(e + r·dA) mod n\n\trda := new(big.Int).Mul(r, new(big.Int).SetBytes(prk))\n\tePlusRda := new(big.Int).Add(rda, new(big.Int).SetBytes(msgHash))\n\ts = new(big.Int).Mod(new(big.Int).Mul(ePlusRda, kInv), u.Params().N)\n\n\tif s.Sign() == 0 {\n\t\treturn nil, nil, fmt.Errorf(\"invalid s value\")\n\t}","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/kgc/user/user.go#L178-L214","documentation":"Raised in the SM2/ECDSA-style Sign routine: after picking random nonce k and computing r = (k*G).x mod N, the result was zero. This is a vanishingly rare algebraic edge case (probability ~1/N); the signature would be invalid, so signing aborts. The input at fault is the freshly generated random k, not the caller's message or key.","triggerScenarios":"Thrown at endpoints/kgc/user/user.go:196 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry the Sign operation with a new random nonce — a different k will virtually never reproduce a zero r","Treat repeated occurrences as a sign of a broken RNG and investigate the entropy source"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}