Inside Bitcoin

251bool CKey::SignCompact(const uint256 &hash, std::vector<unsigned char>& vchSig) const {
252    if (!keydata)
253        return false;
254    vchSig.resize(CPubKey::COMPACT_SIGNATURE_SIZE);
255    int rec = -1;
256    secp256k1_ecdsa_recoverable_signature rsig;
257    int ret = secp256k1_ecdsa_sign_recoverable(secp256k1_context_sign, &rsig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, nullptr);
258    assert(ret);
259    ret = secp256k1_ecdsa_recoverable_signature_serialize_compact(secp256k1_context_static, &vchSig[1], &rec, &rsig);
260    assert(ret);
261    assert(rec != -1);
262    vchSig[0] = 27 + rec + (fCompressed ? 4 : 0);
263    // Additional verification step to prevent using a potentially corrupted signature
264    secp256k1_pubkey epk, rpk;
265    ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &epk, UCharCast(begin()));
266    assert(ret);
267    ret = secp256k1_ecdsa_recover(secp256k1_context_static, &rpk, &rsig, hash.begin());
268    assert(ret);
269    ret = secp256k1_ec_pubkey_cmp(secp256k1_context_static, &epk, &rpk);
270    assert(ret == 0);
271    return true;
272}
273
274bool CKey::SignSchnorr(const uint256& hash, std::span<unsigned char> sig, const uint256* merkle_root, const uint256& aux) const
275{
276    KeyPair kp = ComputeKeyPair(merkle_root);
277    return kp.SignSchnorr(hash, sig, aux);
278}
279
280bool CKey::Load(const CPrivKey &seckey, const CPubKey &vchPubKey, bool fSkipCheck=false) {
281    MakeKeyData();
282    if (!ec_seckey_import_der(secp256k1_context_static, (unsigned char*)begin(), seckey.data(), seckey.size())) {
283        ClearKeyData();
284        return false;
285    }
286    fCompressed = vchPubKey.IsCompressed();
287
288    if (fSkipCheck)
289        return true;
290
291    return VerifyPubKey(vchPubKey);
292}
293
294bool CKey::Derive(CKey& keyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc) const {
295    assert(IsValid());
296    assert(IsCompressed());
297    std::vector<unsigned char, secure_allocator<unsigned char>> vout(64);
298    if ((nChild >> 31) == 0) {
299        CPubKey pubkey = GetPubKey();
300        assert(pubkey.size() == CPubKey::COMPRESSED_SIZE);
301        BIP32Hash(cc, nChild, *pubkey.begin(), pubkey.begin()+1, vout.data());
302    } else {
303        assert(size() == 32);
304        BIP32Hash(cc, nChild, 0, UCharCast(begin()), vout.data());
305    }
306    memcpy(ccChild.begin(), vout.data()+32, 32);
307    keyChild.Set(begin(), begin() + 32, true);
308    bool ret = secp256k1_ec_seckey_tweak_add(secp256k1_context_static, (unsigned char*)keyChild.begin(), vout.data());
309    if (!ret) keyChild.ClearKeyData();
310    return ret;
311}
312
313EllSwiftPubKey CKey::EllSwiftCreate(std::span<const std::byte> ent32) const
314{
315    assert(keydata);
316    assert(ent32.size() == 32);
317    std::array<std::byte, EllSwiftPubKey::size()> encoded_pubkey;
318
319    auto success = secp256k1_ellswift_create(secp256k1_context_sign,
320                                             UCharCast(encoded_pubkey.data()),
321                                             keydata->data(),
322                                             UCharCast(ent32.data()));
323
324    // Should always succeed for valid keys (asserted above).
325    assert(success);
326    return {encoded_pubkey};
327}
328
329ECDHSecret CKey::ComputeBIP324ECDHSecret(const EllSwiftPubKey& their_ellswift, const EllSwiftPubKey& our_ellswift, bool initiating) const
330{
331    assert(keydata);
332
333    ECDHSecret output;
334    // BIP324 uses the initiator as party A, and the responder as party B. Remap the inputs
335    // accordingly:
336    bool success = secp256k1_ellswift_xdh(secp256k1_context_static,
337                                          UCharCast(output.data()),
338                                          UCharCast(initiating ? our_ellswift.data() : their_ellswift.data()),
339                                          UCharCast(initiating ? their_ellswift.data() : our_ellswift.data()),
340                                          keydata->data(),
341                                          initiating ? 0 : 1,
342                                          secp256k1_ellswift_xdh_hash_function_bip324,
343                                          nullptr);
344    // Should always succeed for valid keys (assert above).
345    assert(success);
346    return output;
347}
348
349KeyPair CKey::ComputeKeyPair(const uint256* merkle_root) const
350{
351    return KeyPair(*this, merkle_root);
352}
353
354CKey GenerateRandomKey(bool compressed) noexcept
355{
356    CKey key;
357    key.MakeNewKey(/*fCompressed=*/compressed);
358    return key;
359}
360
361bool CExtKey::Derive(CExtKey &out, unsigned int _nChild) const {
362    if (nDepth == std::numeric_limits<unsigned char>::max()) return false;
363    out.nDepth = nDepth + 1;
364    out.fingerprint = id_key_fingerprint();
365    out.nChild = _nChild;
366    return key.Derive(out.key, out.chaincode, _nChild, chaincode);
367}
368
369std::optional<std::pair<CExtKey, KeyOriginInfo>> DeriveExtKey(const CExtKey& ext_key, const std::vector<uint32_t>& path)
370{
371    CExtKey descendant = ext_key;
372    KeyOriginInfo origin;
373    origin.fingerprint = ext_key.id_key_fingerprint();
374    origin.path = path;
375    for (uint32_t i : path) {
376        if (!descendant.Derive(descendant, i)) return std::nullopt;
377    }
378    return std::make_pair(descendant, origin);
379}
380
381void CExtKey::SetSeed(std::span<const std::byte> seed)
382{
383    Assert(16 <= seed.size() && seed.size() <= 64);
384    static const unsigned char hashkey[] = {'B','i','t','c','o','i','n',' ','s','e','e','d'};
385    std::vector<unsigned char, secure_allocator<unsigned char>> vout(64);
386    CHMAC_SHA512{hashkey, sizeof(hashkey)}.Write(UCharCast(seed.data()), seed.size()).Finalize(vout.data());
387    key.Set(vout.data(), vout.data() + 32, true);
388    memcpy(chaincode.begin(), vout.data() + 32, 32);
389    nDepth = 0;
390    nChild = 0;
391    fingerprint.fill(0);
392}
393
394CExtPubKey CExtKey::Neuter() const {
395    CExtPubKey ret;
396    ret.nDepth = nDepth;
397    ret.fingerprint = fingerprint;
398    ret.nChild = nChild;
399    ret.pubkey = key.GetPubKey();
400    ret.chaincode = chaincode;
401    return ret;
402}
403
404void CExtKey::Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const {
405    code[0] = nDepth;
406    std::ranges::copy(fingerprint, code+1);
407    WriteBE32(code+5, nChild);
408    memcpy(code+9, chaincode.begin(), 32);
409    code[41] = 0;
410    assert(key.size() == 32);
411    memcpy(code+42, key.begin(), 32);
412}
413
414void CExtKey::Decode(const unsigned char code[BIP32_EXTKEY_SIZE]) {
415    nDepth = code[0];
416    std::copy_n(code + 1, fingerprint.size(), fingerprint.begin());
417    nChild = ReadBE32(code+5);
418    memcpy(chaincode.begin(), code+9, 32);
419    key.Set(code+42, code+BIP32_EXTKEY_SIZE, true);
420    if ((nDepth == 0 && (nChild != 0 || ReadLE32(fingerprint.data()) != 0)) || code[41] != 0) key = CKey();
421}
422
423KeyPair::KeyPair(const CKey& key, const uint256* merkle_root)
424{
425    static_assert(std::tuple_size<KeyType>() == sizeof(secp256k1_keypair));
426    MakeKeyPairData();
427    auto keypair = reinterpret_cast<secp256k1_keypair*>(m_keypair->data());
428    bool success = secp256k1_keypair_create(secp256k1_context_sign, keypair, UCharCast(key.data()));
429    if (success && merkle_root) {
430        secp256k1_xonly_pubkey pubkey;
431        unsigned char pubkey_bytes[32];
432        assert(secp256k1_keypair_xonly_pub(secp256k1_context_static, &pubkey, nullptr, keypair));
433        assert(secp256k1_xonly_pubkey_serialize(secp256k1_context_static, pubkey_bytes, &pubkey));
434        uint256 tweak = XOnlyPubKey(pubkey_bytes).ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root);
435        success = secp256k1_keypair_xonly_tweak_add(secp256k1_context_static, keypair, tweak.data());
436    }
437    if (!success) ClearKeyPairData();
438}
439
440bool KeyPair::SignSchnorr(const uint256& hash, std::span<unsigned char> sig, const uint256& aux) const
441{
442    assert(sig.size() == 64);
443    if (!IsValid()) return false;
444    auto keypair = reinterpret_cast<const secp256k1_keypair*>(m_keypair->data());
445    bool ret = secp256k1_schnorrsig_sign32(secp256k1_context_sign, sig.data(), hash.data(), keypair, aux.data());
446    if (ret) {
447        // Additional verification step to prevent using a potentially corrupted signature
448        secp256k1_xonly_pubkey pubkey_verify;
449        ret = secp256k1_keypair_xonly_pub(secp256k1_context_static, &pubkey_verify, nullptr, keypair);
450        ret &= secp256k1_schnorrsig_verify(secp256k1_context_static, sig.data(), hash.begin(), 32, &pubkey_verify);
451    }
452    if (!ret) memory_cleanse(sig.data(), sig.size());
453    return ret;
454}
455
456bool ECC_InitSanityCheck() {
457    CKey key = GenerateRandomKey();
458    CPubKey pubkey = key.GetPubKey();
459    return key.VerifyPubKey(pubkey);
460}
461
462secp256k1_context* GetSecp256k1SignContext()
463{
464    return secp256k1_context_sign;
465}
466
467/** Initialize the elliptic curve support. May not be called twice without calling ECC_Stop first. */
468static void ECC_Start() {
469    assert(secp256k1_context_sign == nullptr);
470
471    secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
472    assert(ctx != nullptr);
473
474    {
475        // Pass in a random blinding seed to the secp256k1 context.
476        std::vector<unsigned char, secure_allocator<unsigned char>> vseed(32);
477        GetRandBytes(vseed);
478        bool ret = secp256k1_context_randomize(ctx, vseed.data());
479        assert(ret);
480    }
481
482    secp256k1_context_sign = ctx;
483}
484
485/** Deinitialize the elliptic curve support. No-op if ECC_Start wasn't called first. */
486static void ECC_Stop() {
487    secp256k1_context *ctx = secp256k1_context_sign;
488    secp256k1_context_sign = nullptr;
489
490    if (ctx) {
491        secp256k1_context_destroy(ctx);
492    }
493}
494
495ECC_Context::ECC_Context()
496{
497    ECC_Start();
498}
499
500ECC_Context::~ECC_Context()