READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server340 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

19,965 bytes · SHA-256 4d648725fb67c74f… · View upstream ↗

1// Copyright (c) 2009-present The Bitcoin Core developers
2// Copyright (c) 2017 The Zcash developers
3// Distributed under the MIT software license, see the accompanying
4// file COPYING or http://www.opensource.org/licenses/mit-license.php.
5
6#include <key.h>
7
8#include <crypto/common.h>
9#include <crypto/hmac_sha512.h>
10#include <hash.h>
11#include <random.h>
12
13#include <secp256k1.h>
14#include <secp256k1_ellswift.h>
15#include <secp256k1_extrakeys.h>
16#include <secp256k1_recovery.h>
17#include <secp256k1_schnorrsig.h>
18
19#include <algorithm>
20
21static secp256k1_context* secp256k1_context_sign = nullptr;
22
23/** These functions are taken from the libsecp256k1 distribution and are very ugly. */
24
25/**
26 * This parses a format loosely based on a DER encoding of the ECPrivateKey type from
27 * section C.4 of SEC 1 <https://www.secg.org/sec1-v2.pdf>, with the following caveats:
28 *
29 * * The octet-length of the SEQUENCE must be encoded as 1 or 2 octets. It is not
30 *   required to be encoded as one octet if it is less than 256, as DER would require.
31 * * The octet-length of the SEQUENCE must not be greater than the remaining
32 *   length of the key encoding, but need not match it (i.e. the encoding may contain
33 *   junk after the encoded SEQUENCE).
34 * * The privateKey OCTET STRING is zero-filled on the left to 32 octets.
35 * * Anything after the encoding of the privateKey OCTET STRING is ignored, whether
36 *   or not it is validly encoded DER.
37 *
38 * out32 must point to an output buffer of length at least 32 bytes.
39 */
40int ec_seckey_import_der(const secp256k1_context* ctx, unsigned char *out32, const unsigned char *seckey, size_t seckeylen) {
41    const unsigned char *end = seckey + seckeylen;
42    memset(out32, 0, 32);
43    /* sequence header */
44    if (end - seckey < 1 || *seckey != 0x30u) {
45        return 0;
46    }
47    seckey++;
48    /* sequence length constructor */
49    if (end - seckey < 1 || !(*seckey & 0x80u)) {
50        return 0;
51    }
52    ptrdiff_t lenb = *seckey & ~0x80u; seckey++;
53    if (lenb < 1 || lenb > 2) {
54        return 0;
55    }
56    if (end - seckey < lenb) {
57        return 0;
58    }
59    /* sequence length */
60    ptrdiff_t len = seckey[lenb-1] | (lenb > 1 ? seckey[lenb-2] << 8 : 0u);
61    seckey += lenb;
62    if (end - seckey < len) {
63        return 0;
64    }
65    /* sequence element 0: version number (=1) */
66    if (end - seckey < 3 || seckey[0] != 0x02u || seckey[1] != 0x01u || seckey[2] != 0x01u) {
67        return 0;
68    }
69    seckey += 3;
70    /* sequence element 1: octet string, up to 32 bytes */
71    if (end - seckey < 2 || seckey[0] != 0x04u) {
72        return 0;
73    }
74    ptrdiff_t oslen = seckey[1];
75    seckey += 2;
76    if (oslen > 32 || end - seckey < oslen) {
77        return 0;
78    }
79    memcpy(out32 + (32 - oslen), seckey, oslen);
80    if (!secp256k1_ec_seckey_verify(ctx, out32)) {
81        memset(out32, 0, 32);
82        return 0;
83    }
84    return 1;
85}
86
87/**
88 * This serializes to a DER encoding of the ECPrivateKey type from section C.4 of SEC 1
89 * <https://www.secg.org/sec1-v2.pdf>. The optional parameters and publicKey fields are
90 * included.
91 *
92 * seckey must point to an output buffer of length at least CKey::SIZE bytes.
93 * seckeylen must initially be set to the size of the seckey buffer. Upon return it
94 * will be set to the number of bytes used in the buffer.
95 * key32 must point to a 32-byte raw private key.
96 */
97int ec_seckey_export_der(const secp256k1_context *ctx, unsigned char *seckey, size_t *seckeylen, const unsigned char *key32, bool compressed) {
98    assert(*seckeylen >= CKey::SIZE);
99    secp256k1_pubkey pubkey;
100    size_t pubkeylen = 0;
101    if (!secp256k1_ec_pubkey_create(ctx, &pubkey, key32)) {
102        *seckeylen = 0;
103        return 0;
104    }
105    if (compressed) {
106        static const unsigned char begin[] = {
107            0x30,0x81,0xD3,0x02,0x01,0x01,0x04,0x20
108        };
109        static const unsigned char middle[] = {
110            0xA0,0x81,0x85,0x30,0x81,0x82,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
111            0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
112            0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
113            0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
114            0x21,0x02,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
115            0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
116            0x17,0x98,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
117            0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
118            0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x24,0x03,0x22,0x00
119        };
120        unsigned char *ptr = seckey;
121        memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
122        memcpy(ptr, key32, 32); ptr += 32;
123        memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
124        pubkeylen = CPubKey::COMPRESSED_SIZE;
125        secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
126        ptr += pubkeylen;
127        *seckeylen = ptr - seckey;
128        assert(*seckeylen == CKey::COMPRESSED_SIZE);
129    } else {
130        static const unsigned char begin[] = {
131            0x30,0x82,0x01,0x13,0x02,0x01,0x01,0x04,0x20
132        };
133        static const unsigned char middle[] = {
134            0xA0,0x81,0xA5,0x30,0x81,0xA2,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
135            0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
136            0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
137            0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
138            0x41,0x04,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
139            0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
140            0x17,0x98,0x48,0x3A,0xDA,0x77,0x26,0xA3,0xC4,0x65,0x5D,0xA4,0xFB,0xFC,0x0E,0x11,
141            0x08,0xA8,0xFD,0x17,0xB4,0x48,0xA6,0x85,0x54,0x19,0x9C,0x47,0xD0,0x8F,0xFB,0x10,
142            0xD4,0xB8,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
143            0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
144            0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x44,0x03,0x42,0x00
145        };
146        unsigned char *ptr = seckey;
147        memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
148        memcpy(ptr, key32, 32); ptr += 32;
149        memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
150        pubkeylen = CPubKey::SIZE;
151        secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
152        ptr += pubkeylen;
153        *seckeylen = ptr - seckey;
154        assert(*seckeylen == CKey::SIZE);
155    }
156    return 1;
157}
158
159bool CKey::Check(const unsigned char *vch) {
160    return secp256k1_ec_seckey_verify(secp256k1_context_static, vch);
161}
162
163void CKey::MakeNewKey(bool fCompressedIn) {
164    MakeKeyData();
165    do {
166        GetStrongRandBytes(*keydata);
167    } while (!Check(keydata->data()));
168    fCompressed = fCompressedIn;
169}
170
171CPrivKey CKey::GetPrivKey() const {
172    assert(keydata);
173    CPrivKey seckey;
174    int ret;
175    size_t seckeylen;
176    seckey.resize(SIZE);
177    seckeylen = SIZE;
178    ret = ec_seckey_export_der(secp256k1_context_sign, seckey.data(), &seckeylen, UCharCast(begin()), fCompressed);
179    assert(ret);
180    seckey.resize(seckeylen);
181    return seckey;
182}
183
184CPubKey CKey::GetPubKey() const {
185    assert(keydata);
186    secp256k1_pubkey pubkey;
187    size_t clen = CPubKey::SIZE;
188    CPubKey result;
189    int ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pubkey, UCharCast(begin()));
190    assert(ret);
191    secp256k1_ec_pubkey_serialize(secp256k1_context_static, (unsigned char*)result.begin(), &clen, &pubkey, fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
192    assert(result.size() == clen);
193    assert(result.IsValid());
194    return result;
195}
196
197// Check that the sig has a low R value and will be less than 71 bytes
198bool SigHasLowR(const secp256k1_ecdsa_signature* sig)
199{
200    unsigned char compact_sig[64];
201    secp256k1_ecdsa_signature_serialize_compact(secp256k1_context_static, compact_sig, sig);
202
203    // In DER serialization, all values are interpreted as big-endian, signed integers. The highest bit in the integer indicates
204    // its signed-ness; 0 is positive, 1 is negative. When the value is interpreted as a negative integer, it must be converted
205    // to a positive value by prepending a 0x00 byte so that the highest bit is 0. We can avoid this prepending by ensuring that
206    // our highest bit is always 0, and thus we must check that the first byte is less than 0x80.
207    return compact_sig[0] < 0x80;
208}
209
210bool CKey::Sign(const uint256 &hash, std::vector<unsigned char>& vchSig, bool grind, uint32_t test_case) const {
211    if (!keydata)
212        return false;
213    vchSig.resize(CPubKey::SIGNATURE_SIZE);
214    size_t nSigLen = CPubKey::SIGNATURE_SIZE;
215    unsigned char extra_entropy[32] = {0};
216    WriteLE32(extra_entropy, test_case);
217    secp256k1_ecdsa_signature sig;
218    uint32_t counter = 0;
219    int ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, (!grind && test_case) ? extra_entropy : nullptr);
220
221    // Grind for low R
222    while (ret && !SigHasLowR(&sig) && grind) {
223        WriteLE32(extra_entropy, ++counter);
224        ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, extra_entropy);
225    }
226    assert(ret);
227    secp256k1_ecdsa_signature_serialize_der(secp256k1_context_static, vchSig.data(), &nSigLen, &sig);
228    vchSig.resize(nSigLen);
229    // Additional verification step to prevent using a potentially corrupted signature
230    secp256k1_pubkey pk;
231    ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pk, UCharCast(begin()));
232    assert(ret);
233    ret = secp256k1_ecdsa_verify(secp256k1_context_static, &sig, hash.begin(), &pk);
234    assert(ret);
235    return true;
236}
237
238bool CKey::VerifyPubKey(const CPubKey& pubkey) const {
239    if (pubkey.IsCompressed() != fCompressed) {
240        return false;
241    }
242    unsigned char rnd[8];
243    std::string str = "Bitcoin key verification\n";
244    GetRandBytes(rnd);
245    uint256 hash{Hash(str, rnd)};
246    std::vector<unsigned char> vchSig;
247    Sign(hash, vchSig);
248    return pubkey.Verify(hash, vchSig);
249}
250

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.