Bitcoin Core  22.99.0
P2P Digital Currency
key.cpp
Go to the documentation of this file.
1 // Copyright (c) 2009-2020 The Bitcoin Core developers
2 // Copyright (c) 2017 The Zcash developers
3 // Distributed under the MIT software license, see the accompanying
4 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
5 
6 #include <key.h>
7 
8 #include <crypto/common.h>
9 #include <crypto/hmac_sha512.h>
10 #include <hash.h>
11 #include <random.h>
12 
13 #include <secp256k1.h>
14 #include <secp256k1_extrakeys.h>
15 #include <secp256k1_recovery.h>
16 #include <secp256k1_schnorrsig.h>
17 
19 
37 int ec_seckey_import_der(const secp256k1_context* ctx, unsigned char *out32, const unsigned char *seckey, size_t seckeylen) {
38  const unsigned char *end = seckey + seckeylen;
39  memset(out32, 0, 32);
40  /* sequence header */
41  if (end - seckey < 1 || *seckey != 0x30u) {
42  return 0;
43  }
44  seckey++;
45  /* sequence length constructor */
46  if (end - seckey < 1 || !(*seckey & 0x80u)) {
47  return 0;
48  }
49  ptrdiff_t lenb = *seckey & ~0x80u; seckey++;
50  if (lenb < 1 || lenb > 2) {
51  return 0;
52  }
53  if (end - seckey < lenb) {
54  return 0;
55  }
56  /* sequence length */
57  ptrdiff_t len = seckey[lenb-1] | (lenb > 1 ? seckey[lenb-2] << 8 : 0u);
58  seckey += lenb;
59  if (end - seckey < len) {
60  return 0;
61  }
62  /* sequence element 0: version number (=1) */
63  if (end - seckey < 3 || seckey[0] != 0x02u || seckey[1] != 0x01u || seckey[2] != 0x01u) {
64  return 0;
65  }
66  seckey += 3;
67  /* sequence element 1: octet string, up to 32 bytes */
68  if (end - seckey < 2 || seckey[0] != 0x04u) {
69  return 0;
70  }
71  ptrdiff_t oslen = seckey[1];
72  seckey += 2;
73  if (oslen > 32 || end - seckey < oslen) {
74  return 0;
75  }
76  memcpy(out32 + (32 - oslen), seckey, oslen);
77  if (!secp256k1_ec_seckey_verify(ctx, out32)) {
78  memset(out32, 0, 32);
79  return 0;
80  }
81  return 1;
82 }
83 
94 int ec_seckey_export_der(const secp256k1_context *ctx, unsigned char *seckey, size_t *seckeylen, const unsigned char *key32, bool compressed) {
95  assert(*seckeylen >= CKey::SIZE);
96  secp256k1_pubkey pubkey;
97  size_t pubkeylen = 0;
98  if (!secp256k1_ec_pubkey_create(ctx, &pubkey, key32)) {
99  *seckeylen = 0;
100  return 0;
101  }
102  if (compressed) {
103  static const unsigned char begin[] = {
104  0x30,0x81,0xD3,0x02,0x01,0x01,0x04,0x20
105  };
106  static const unsigned char middle[] = {
107  0xA0,0x81,0x85,0x30,0x81,0x82,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
108  0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
109  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
110  0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
111  0x21,0x02,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
112  0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
113  0x17,0x98,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
114  0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
115  0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x24,0x03,0x22,0x00
116  };
117  unsigned char *ptr = seckey;
118  memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
119  memcpy(ptr, key32, 32); ptr += 32;
120  memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
121  pubkeylen = CPubKey::COMPRESSED_SIZE;
122  secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
123  ptr += pubkeylen;
124  *seckeylen = ptr - seckey;
125  assert(*seckeylen == CKey::COMPRESSED_SIZE);
126  } else {
127  static const unsigned char begin[] = {
128  0x30,0x82,0x01,0x13,0x02,0x01,0x01,0x04,0x20
129  };
130  static const unsigned char middle[] = {
131  0xA0,0x81,0xA5,0x30,0x81,0xA2,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
132  0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
133  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
134  0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
135  0x41,0x04,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
136  0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
137  0x17,0x98,0x48,0x3A,0xDA,0x77,0x26,0xA3,0xC4,0x65,0x5D,0xA4,0xFB,0xFC,0x0E,0x11,
138  0x08,0xA8,0xFD,0x17,0xB4,0x48,0xA6,0x85,0x54,0x19,0x9C,0x47,0xD0,0x8F,0xFB,0x10,
139  0xD4,0xB8,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
140  0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
141  0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x44,0x03,0x42,0x00
142  };
143  unsigned char *ptr = seckey;
144  memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
145  memcpy(ptr, key32, 32); ptr += 32;
146  memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
147  pubkeylen = CPubKey::SIZE;
148  secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
149  ptr += pubkeylen;
150  *seckeylen = ptr - seckey;
151  assert(*seckeylen == CKey::SIZE);
152  }
153  return 1;
154 }
155 
156 bool CKey::Check(const unsigned char *vch) {
158 }
159 
160 void CKey::MakeNewKey(bool fCompressedIn) {
161  do {
162  GetStrongRandBytes(keydata.data(), keydata.size());
163  } while (!Check(keydata.data()));
164  fValid = true;
165  fCompressed = fCompressedIn;
166 }
167 
169 {
170  assert(fValid);
172 }
173 
175  assert(fValid);
176  CPrivKey seckey;
177  int ret;
178  size_t seckeylen;
179  seckey.resize(SIZE);
180  seckeylen = SIZE;
181  ret = ec_seckey_export_der(secp256k1_context_sign, seckey.data(), &seckeylen, begin(), fCompressed);
182  assert(ret);
183  seckey.resize(seckeylen);
184  return seckey;
185 }
186 
188  assert(fValid);
189  secp256k1_pubkey pubkey;
190  size_t clen = CPubKey::SIZE;
191  CPubKey result;
193  assert(ret);
195  assert(result.size() == clen);
196  assert(result.IsValid());
197  return result;
198 }
199 
200 // Check that the sig has a low R value and will be less than 71 bytes
202 {
203  unsigned char compact_sig[64];
205 
206  // In DER serialization, all values are interpreted as big-endian, signed integers. The highest bit in the integer indicates
207  // its signed-ness; 0 is positive, 1 is negative. When the value is interpreted as a negative integer, it must be converted
208  // to a positive value by prepending a 0x00 byte so that the highest bit is 0. We can avoid this prepending by ensuring that
209  // our highest bit is always 0, and thus we must check that the first byte is less than 0x80.
210  return compact_sig[0] < 0x80;
211 }
212 
213 bool CKey::Sign(const uint256 &hash, std::vector<unsigned char>& vchSig, bool grind, uint32_t test_case) const {
214  if (!fValid)
215  return false;
216  vchSig.resize(CPubKey::SIGNATURE_SIZE);
217  size_t nSigLen = CPubKey::SIGNATURE_SIZE;
218  unsigned char extra_entropy[32] = {0};
219  WriteLE32(extra_entropy, test_case);
221  uint32_t counter = 0;
222  int ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), begin(), secp256k1_nonce_function_rfc6979, (!grind && test_case) ? extra_entropy : nullptr);
223 
224  // Grind for low R
225  while (ret && !SigHasLowR(&sig) && grind) {
226  WriteLE32(extra_entropy, ++counter);
228  }
229  assert(ret);
230  secp256k1_ecdsa_signature_serialize_der(secp256k1_context_sign, vchSig.data(), &nSigLen, &sig);
231  vchSig.resize(nSigLen);
232  // Additional verification step to prevent using a potentially corrupted signature
233  secp256k1_pubkey pk;
235  assert(ret);
236  ret = secp256k1_ecdsa_verify(GetVerifyContext(), &sig, hash.begin(), &pk);
237  assert(ret);
238  return true;
239 }
240 
241 bool CKey::VerifyPubKey(const CPubKey& pubkey) const {
242  if (pubkey.IsCompressed() != fCompressed) {
243  return false;
244  }
245  unsigned char rnd[8];
246  std::string str = "Bitcoin key verification\n";
247  GetRandBytes(rnd, sizeof(rnd));
248  uint256 hash;
249  CHash256().Write(MakeUCharSpan(str)).Write(rnd).Finalize(hash);
250  std::vector<unsigned char> vchSig;
251  Sign(hash, vchSig);
252  return pubkey.Verify(hash, vchSig);
253 }
254 
255 bool CKey::SignCompact(const uint256 &hash, std::vector<unsigned char>& vchSig) const {
256  if (!fValid)
257  return false;
258  vchSig.resize(CPubKey::COMPACT_SIGNATURE_SIZE);
259  int rec = -1;
262  assert(ret);
264  assert(ret);
265  assert(rec != -1);
266  vchSig[0] = 27 + rec + (fCompressed ? 4 : 0);
267  // Additional verification step to prevent using a potentially corrupted signature
268  secp256k1_pubkey epk, rpk;
270  assert(ret);
271  ret = secp256k1_ecdsa_recover(GetVerifyContext(), &rpk, &rsig, hash.begin());
272  assert(ret);
273  ret = secp256k1_ec_pubkey_cmp(GetVerifyContext(), &epk, &rpk);
274  assert(ret == 0);
275  return true;
276 }
277 
278 bool CKey::SignSchnorr(const uint256& hash, Span<unsigned char> sig, const uint256* merkle_root, const uint256& aux) const
279 {
280  assert(sig.size() == 64);
281  secp256k1_keypair keypair;
282  if (!secp256k1_keypair_create(secp256k1_context_sign, &keypair, begin())) return false;
283  if (merkle_root) {
284  secp256k1_xonly_pubkey pubkey;
285  if (!secp256k1_keypair_xonly_pub(secp256k1_context_sign, &pubkey, nullptr, &keypair)) return false;
286  unsigned char pubkey_bytes[32];
287  if (!secp256k1_xonly_pubkey_serialize(secp256k1_context_sign, pubkey_bytes, &pubkey)) return false;
288  uint256 tweak = XOnlyPubKey(pubkey_bytes).ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root);
289  if (!secp256k1_keypair_xonly_tweak_add(GetVerifyContext(), &keypair, tweak.data())) return false;
290  }
291  bool ret = secp256k1_schnorrsig_sign(secp256k1_context_sign, sig.data(), hash.data(), &keypair, (unsigned char*)aux.data());
292  if (ret) {
293  // Additional verification step to prevent using a potentially corrupted signature
294  secp256k1_xonly_pubkey pubkey_verify;
295  ret = secp256k1_keypair_xonly_pub(GetVerifyContext(), &pubkey_verify, nullptr, &keypair);
296  ret &= secp256k1_schnorrsig_verify(GetVerifyContext(), sig.data(), hash.begin(), 32, &pubkey_verify);
297  }
298  if (!ret) memory_cleanse(sig.data(), sig.size());
299  memory_cleanse(&keypair, sizeof(keypair));
300  return ret;
301 }
302 
303 bool CKey::Load(const CPrivKey &seckey, const CPubKey &vchPubKey, bool fSkipCheck=false) {
304  if (!ec_seckey_import_der(secp256k1_context_sign, (unsigned char*)begin(), seckey.data(), seckey.size()))
305  return false;
306  fCompressed = vchPubKey.IsCompressed();
307  fValid = true;
308 
309  if (fSkipCheck)
310  return true;
311 
312  return VerifyPubKey(vchPubKey);
313 }
314 
315 bool CKey::Derive(CKey& keyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc) const {
316  assert(IsValid());
317  assert(IsCompressed());
318  std::vector<unsigned char, secure_allocator<unsigned char>> vout(64);
319  if ((nChild >> 31) == 0) {
320  CPubKey pubkey = GetPubKey();
321  assert(pubkey.size() == CPubKey::COMPRESSED_SIZE);
322  BIP32Hash(cc, nChild, *pubkey.begin(), pubkey.begin()+1, vout.data());
323  } else {
324  assert(size() == 32);
325  BIP32Hash(cc, nChild, 0, begin(), vout.data());
326  }
327  memcpy(ccChild.begin(), vout.data()+32, 32);
328  memcpy((unsigned char*)keyChild.begin(), begin(), 32);
329  bool ret = secp256k1_ec_seckey_tweak_add(secp256k1_context_sign, (unsigned char*)keyChild.begin(), vout.data());
330  keyChild.fCompressed = true;
331  keyChild.fValid = ret;
332  return ret;
333 }
334 
335 bool CExtKey::Derive(CExtKey &out, unsigned int _nChild) const {
336  out.nDepth = nDepth + 1;
337  CKeyID id = key.GetPubKey().GetID();
338  memcpy(out.vchFingerprint, &id, 4);
339  out.nChild = _nChild;
340  return key.Derive(out.key, out.chaincode, _nChild, chaincode);
341 }
342 
344 {
345  static const unsigned char hashkey[] = {'B','i','t','c','o','i','n',' ','s','e','e','d'};
346  std::vector<unsigned char, secure_allocator<unsigned char>> vout(64);
347  CHMAC_SHA512{hashkey, sizeof(hashkey)}.Write(seed.data(), seed.size()).Finalize(vout.data());
348  key.Set(vout.data(), vout.data() + 32, true);
349  memcpy(chaincode.begin(), vout.data() + 32, 32);
350  nDepth = 0;
351  nChild = 0;
352  memset(vchFingerprint, 0, sizeof(vchFingerprint));
353 }
354 
356  CExtPubKey ret;
357  ret.nDepth = nDepth;
358  memcpy(ret.vchFingerprint, vchFingerprint, 4);
359  ret.nChild = nChild;
360  ret.pubkey = key.GetPubKey();
361  ret.chaincode = chaincode;
362  return ret;
363 }
364 
365 void CExtKey::Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const {
366  code[0] = nDepth;
367  memcpy(code+1, vchFingerprint, 4);
368  WriteBE32(code+5, nChild);
369  memcpy(code+9, chaincode.begin(), 32);
370  code[41] = 0;
371  assert(key.size() == 32);
372  memcpy(code+42, key.begin(), 32);
373 }
374 
375 void CExtKey::Decode(const unsigned char code[BIP32_EXTKEY_SIZE]) {
376  nDepth = code[0];
377  memcpy(vchFingerprint, code+1, 4);
378  nChild = ReadBE32(code+5);
379  memcpy(chaincode.begin(), code+9, 32);
380  key.Set(code+42, code+BIP32_EXTKEY_SIZE, true);
381  if ((nDepth == 0 && (nChild != 0 || ReadLE32(vchFingerprint) != 0)) || code[41] != 0) key = CKey();
382 }
383 
385  CKey key;
386  key.MakeNewKey(true);
387  CPubKey pubkey = key.GetPubKey();
388  return key.VerifyPubKey(pubkey);
389 }
390 
391 void ECC_Start() {
392  assert(secp256k1_context_sign == nullptr);
393 
395  assert(ctx != nullptr);
396 
397  {
398  // Pass in a random blinding seed to the secp256k1 context.
399  std::vector<unsigned char, secure_allocator<unsigned char>> vseed(32);
400  GetRandBytes(vseed.data(), 32);
401  bool ret = secp256k1_context_randomize(ctx, vseed.data());
402  assert(ret);
403  }
404 
406 }
407 
408 void ECC_Stop() {
410  secp256k1_context_sign = nullptr;
411 
412  if (ctx) {
414  }
415 }
CKey::IsCompressed
bool IsCompressed() const
Check whether the public key corresponding to this private key is (to be) compressed.
Definition: key.h:96
secp256k1_ecdsa_signature
Opaque data structured that holds a parsed ECDSA signature.
Definition: secp256k1.h:83
BIP32_EXTKEY_SIZE
const unsigned int BIP32_EXTKEY_SIZE
Definition: pubkey.h:19
CPubKey::SIGNATURE_SIZE
static constexpr unsigned int SIGNATURE_SIZE
Definition: pubkey.h:40
ReadLE32
static uint32_t ReadLE32(const unsigned char *ptr)
Definition: common.h:24
assert
assert(!tx.IsCoinBase())
SECP256K1_CONTEXT_SIGN
#define SECP256K1_CONTEXT_SIGN
Definition: secp256k1.h:185
CKey::MakeNewKey
void MakeNewKey(bool fCompressed)
Generate a new private key using a cryptographic PRNG.
Definition: key.cpp:160
secp256k1_ecdsa_signature_serialize_der
SECP256K1_API int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize an ECDSA signature in DER format.
Definition: secp256k1.c:412
CHash256::Write
CHash256 & Write(Span< const unsigned char > input)
Definition: hash.h:37
secp256k1_ecdsa_signature_serialize_compact
SECP256K1_API int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context *ctx, unsigned char *output64, const secp256k1_ecdsa_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Serialize an ECDSA signature in compact (64 byte) format.
Definition: secp256k1.c:424
secp256k1_context_struct
Definition: secp256k1.c:75
MakeUCharSpan
constexpr auto MakeUCharSpan(V &&v) -> decltype(UCharSpanCast(MakeSpan(std::forward< V >(v))))
Like MakeSpan, but for (const) unsigned char member types only.
Definition: span.h:278
WriteLE32
static void WriteLE32(unsigned char *ptr, uint32_t x)
Definition: common.h:44
base_blob::data
const unsigned char * data() const
Definition: uint256.h:55
CExtKey::Derive
bool Derive(CExtKey &out, unsigned int nChild) const
Definition: key.cpp:335
CKey::GetPrivKey
CPrivKey GetPrivKey() const
Convert the private key to a CPrivKey (serialized OpenSSL private key data).
Definition: key.cpp:174
GetVerifyContext
const secp256k1_context * GetVerifyContext()
Access to the internal secp256k1 context used for verification.
Definition: pubkey.cpp:394
CPubKey::SIZE
static constexpr unsigned int SIZE
secp256k1:
Definition: pubkey.h:38
CExtKey::vchFingerprint
unsigned char vchFingerprint[4]
Definition: key.h:163
CKey::Set
void Set(const T pbegin, const T pend, bool fCompressedIn)
Initialize using begin and end iterators to byte data.
Definition: key.h:73
CPrivKey
std::vector< unsigned char, secure_allocator< unsigned char > > CPrivKey
CPrivKey is a serialized private key, with all parameters included (SIZE bytes)
Definition: key.h:23
secp256k1_ec_seckey_negate
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_negate(const secp256k1_context *ctx, unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Negates a secret key in place.
Definition: secp256k1.c:622
secp256k1_ecdsa_sign_recoverable
SECP256K1_API int secp256k1_ecdsa_sign_recoverable(const secp256k1_context *ctx, secp256k1_ecdsa_recoverable_signature *sig, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create a recoverable ECDSA signature.
Definition: main_impl.h:123
ECC_InitSanityCheck
bool ECC_InitSanityCheck()
Check that required EC support is available at runtime.
Definition: key.cpp:384
secp256k1_keypair_xonly_pub
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_pub(const secp256k1_context *ctx, secp256k1_xonly_pubkey *pubkey, int *pk_parity, const secp256k1_keypair *keypair) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4)
Get the x-only public key from a keypair.
Definition: main_impl.h:235
CKey::fCompressed
bool fCompressed
Whether the public key corresponding to this private key is (to be) compressed.
Definition: key.h:48
CExtKey::Encode
void Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const
Definition: key.cpp:365
XOnlyPubKey
Definition: pubkey.h:218
secp256k1_recovery.h
ReadBE32
static uint32_t ReadBE32(const unsigned char *ptr)
Definition: common.h:63
hmac_sha512.h
CKey::Derive
bool Derive(CKey &keyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode &cc) const
Derive BIP32 child key.
Definition: key.cpp:315
CKeyID
A reference to a CKey: the Hash160 of its serialized public key.
Definition: pubkey.h:22
CExtPubKey::nDepth
unsigned char nDepth
Definition: pubkey.h:286
common.h
memory_cleanse
void memory_cleanse(void *ptr, size_t len)
Secure overwrite a buffer (possibly containing secret data) with zero-bytes.
Definition: cleanse.cpp:14
secp256k1_ecdsa_recoverable_signature
Opaque data structured that holds a parsed ECDSA signature, supporting pubkey recovery.
Definition: secp256k1_recovery.h:24
secp256k1_context_destroy
SECP256K1_API void secp256k1_context_destroy(secp256k1_context *ctx)
Destroy a secp256k1 context object (created in dynamically allocated memory).
Definition: secp256k1.c:202
CExtKey::nDepth
unsigned char nDepth
Definition: key.h:162
secp256k1_schnorrsig_sign
SECP256K1_API int secp256k1_schnorrsig_sign(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, unsigned char *aux_rand32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create a Schnorr signature.
Definition: main_impl.h:188
CHMAC_SHA512::Write
CHMAC_SHA512 & Write(const unsigned char *data, size_t len)
Definition: hmac_sha512.h:24
secp256k1_context_create
SECP256K1_API secp256k1_context * secp256k1_context_create(unsigned int flags) SECP256K1_WARN_UNUSED_RESULT
Create a secp256k1 context object (in dynamically allocated memory).
Definition: secp256k1.c:158
ec_seckey_export_der
int ec_seckey_export_der(const secp256k1_context *ctx, unsigned char *seckey, size_t *seckeylen, const unsigned char *key32, bool compressed)
This serializes to a DER encoding of the ECPrivateKey type from section C.4 of SEC 1 https://www....
Definition: key.cpp:94
secp256k1_schnorrsig_verify
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(const secp256k1_context *ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_xonly_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5)
Verify a Schnorr signature.
Definition: main_impl.h:207
ec_seckey_import_der
int ec_seckey_import_der(const secp256k1_context *ctx, unsigned char *out32, const unsigned char *seckey, size_t seckeylen)
These functions are taken from the libsecp256k1 distribution and are very ugly.
Definition: key.cpp:37
CKey::SIZE
static const unsigned int SIZE
secp256k1:
Definition: key.h:32
CExtPubKey::nChild
unsigned int nChild
Definition: pubkey.h:288
CExtKey::SetSeed
void SetSeed(Span< const uint8_t > seed)
Definition: key.cpp:343
Span::size
constexpr std::size_t size() const noexcept
Definition: span.h:186
Span
A Span is an object that can refer to a contiguous sequence of objects.
Definition: span.h:96
secp256k1_keypair
Opaque data structure that holds a keypair consisting of a secret and a public key.
Definition: secp256k1_extrakeys.h:33
secp256k1_ecdsa_verify
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify(const secp256k1_context *ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const secp256k1_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Verify an ECDSA signature.
Definition: secp256k1.c:456
CPubKey::begin
const unsigned char * begin() const
Definition: pubkey.h:113
CKey::begin
const unsigned char * begin() const
Definition: key.h:89
secp256k1_schnorrsig.h
random.h
secp256k1_ec_pubkey_serialize
SECP256K1_API int secp256k1_ec_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey *pubkey, unsigned int flags) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize a pubkey object into a serialized byte sequence.
Definition: secp256k1.c:302
secp256k1.h
secp256k1_keypair_create
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_create(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the keypair for a secret key.
Definition: main_impl.h:197
ECC_Stop
void ECC_Stop()
Deinitialize the elliptic curve support.
Definition: key.cpp:408
SECP256K1_EC_COMPRESSED
#define SECP256K1_EC_COMPRESSED
Flag to pass to secp256k1_ec_pubkey_serialize.
Definition: secp256k1.h:190
CExtKey
Definition: key.h:161
CExtPubKey::vchFingerprint
unsigned char vchFingerprint[4]
Definition: pubkey.h:287
secp256k1_ecdsa_recover
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_recover(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const secp256k1_ecdsa_recoverable_signature *sig, const unsigned char *msghash32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Recover an ECDSA public key from a signature.
Definition: main_impl.h:137
CPubKey::Verify
bool Verify(const uint256 &hash, const std::vector< unsigned char > &vchSig) const
Verify a DER signature (~72 bytes).
Definition: pubkey.cpp:253
CKey::SignCompact
bool SignCompact(const uint256 &hash, std::vector< unsigned char > &vchSig) const
Create a compact signature (65 bytes), which allows reconstructing the used public key.
Definition: key.cpp:255
GetRandBytes
void GetRandBytes(unsigned char *buf, int num) noexcept
Overall design of the RNG and entropy sources.
Definition: random.cpp:584
WriteBE32
static void WriteBE32(unsigned char *ptr, uint32_t x)
Definition: common.h:77
CKey::IsValid
bool IsValid() const
Check whether this private key is valid.
Definition: key.h:93
CKey::Sign
bool Sign(const uint256 &hash, std::vector< unsigned char > &vchSig, bool grind=true, uint32_t test_case=0) const
Create a DER-serialized signature.
Definition: key.cpp:213
SECP256K1_EC_UNCOMPRESSED
#define SECP256K1_EC_UNCOMPRESSED
Definition: secp256k1.h:191
CHash256::Finalize
void Finalize(Span< unsigned char > output)
Definition: hash.h:30
secp256k1_ec_pubkey_cmp
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_cmp(const secp256k1_context *ctx, const secp256k1_pubkey *pubkey1, const secp256k1_pubkey *pubkey2) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compare two public keys using lexicographic (of compressed serialization) order.
Definition: secp256k1.c:325
CPubKey::size
unsigned int size() const
Simple read-only vector-like interface to the pubkey data.
Definition: pubkey.h:111
CPubKey::COMPRESSED_SIZE
static constexpr unsigned int COMPRESSED_SIZE
Definition: pubkey.h:39
uint256
256-bit opaque blob.
Definition: uint256.h:124
CExtKey::nChild
unsigned int nChild
Definition: key.h:164
CKey::GetPubKey
CPubKey GetPubKey() const
Compute the public key from a private key.
Definition: key.cpp:187
GetStrongRandBytes
void GetStrongRandBytes(unsigned char *buf, int num) noexcept
Gather entropy from various sources, feed it into the internal PRNG, and generate random data using i...
Definition: random.cpp:585
secp256k1_ecdsa_sign
SECP256K1_API int secp256k1_ecdsa_sign(const secp256k1_context *ctx, secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create an ECDSA signature.
Definition: secp256k1.c:567
CKey::Negate
bool Negate()
Negate private key.
Definition: key.cpp:168
CPubKey::IsCompressed
bool IsCompressed() const
Check whether this is a compressed public key.
Definition: pubkey.h:192
secp256k1_ec_seckey_verify
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify(const secp256k1_context *ctx, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Verify an ECDSA secret key.
Definition: secp256k1.c:581
secp256k1_ecdsa_recoverable_signature_serialize_compact
SECP256K1_API int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_context *ctx, unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize an ECDSA signature in compact format (64 bytes + recovery id).
Definition: main_impl.h:60
CExtKey::chaincode
ChainCode chaincode
Definition: key.h:165
BIP32Hash
void BIP32Hash(const ChainCode &chainCode, unsigned int nChild, unsigned char header, const unsigned char data[32], unsigned char output[64])
Definition: hash.cpp:75
ECC_Start
void ECC_Start()
Initialize the elliptic curve support.
Definition: key.cpp:391
key.h
Span::data
constexpr C * data() const noexcept
Definition: span.h:173
CPubKey
An encapsulated public key.
Definition: pubkey.h:32
CKey::size
unsigned int size() const
Simple read-only vector-like interface.
Definition: key.h:87
base_blob::IsNull
bool IsNull() const
Definition: uint256.h:31
CKey
An encapsulated private key.
Definition: key.h:26
CExtPubKey::chaincode
ChainCode chaincode
Definition: pubkey.h:289
CKey::VerifyPubKey
bool VerifyPubKey(const CPubKey &vchPubKey) const
Verify thoroughly whether a private key and a public key match.
Definition: key.cpp:241
CExtKey::Decode
void Decode(const unsigned char code[BIP32_EXTKEY_SIZE])
Definition: key.cpp:375
CKey::SignSchnorr
bool SignSchnorr(const uint256 &hash, Span< unsigned char > sig, const uint256 *merkle_root, const uint256 &aux) const
Create a BIP-340 Schnorr signature, for the xonly-pubkey corresponding to *this, optionally tweaked b...
Definition: key.cpp:278
CPubKey::COMPACT_SIGNATURE_SIZE
static constexpr unsigned int COMPACT_SIGNATURE_SIZE
Definition: pubkey.h:41
secp256k1_xonly_pubkey_serialize
SECP256K1_API int secp256k1_xonly_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output32, const secp256k1_xonly_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Serialize an xonly_pubkey object into a 32-byte sequence.
Definition: main_impl.h:43
secp256k1_ec_seckey_tweak_add
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_tweak_add(const secp256k1_context *ctx, unsigned char *seckey, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a secret key by adding tweak to it.
Definition: secp256k1.c:668
secp256k1_ec_pubkey_create
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the public key for a secret key.
Definition: secp256k1.c:604
hash.h
XOnlyPubKey::ComputeTapTweakHash
uint256 ComputeTapTweakHash(const uint256 *merkle_root) const
Compute the Taproot tweak as specified in BIP341, with *this as internal key:
Definition: pubkey.cpp:216
secp256k1_keypair_xonly_tweak_add
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_tweak_add(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a keypair by adding tweak32 to the secret key and updating the public key accordingly.
Definition: main_impl.h:256
CKey::fValid
bool fValid
see www.keylength.com script supports up to 75 for single byte push
Definition: key.h:40
CHash256
A hasher class for Bitcoin's 256-bit hash (double SHA-256).
Definition: hash.h:24
CPubKey::IsValid
bool IsValid() const
Definition: pubkey.h:183
secp256k1_context_sign
static secp256k1_context * secp256k1_context_sign
Definition: key.cpp:18
CKey::Load
bool Load(const CPrivKey &privkey, const CPubKey &vchPubKey, bool fSkipCheck)
Load private key and check that public key matches.
Definition: key.cpp:303
CExtPubKey::pubkey
CPubKey pubkey
Definition: pubkey.h:290
CExtKey::Neuter
CExtPubKey Neuter() const
Definition: key.cpp:355
CKey::COMPRESSED_SIZE
static const unsigned int COMPRESSED_SIZE
Definition: key.h:33
secp256k1_extrakeys.h
secp256k1_nonce_function_rfc6979
const SECP256K1_API secp256k1_nonce_function secp256k1_nonce_function_rfc6979
An implementation of RFC6979 (using HMAC-SHA256) as nonce generation function.
Definition: secp256k1.c:508
secp256k1_pubkey
Opaque data structure that holds a parsed and valid public key.
Definition: secp256k1.h:70
CKey::Check
static bool Check(const unsigned char *vch)
Check whether the 32-byte array pointed to by vch is valid keydata.
Definition: key.cpp:156
CExtPubKey
Definition: pubkey.h:285
CExtKey::key
CKey key
Definition: key.h:166
CHMAC_SHA512
A hasher class for HMAC-SHA-512.
Definition: hmac_sha512.h:14
base_blob::begin
unsigned char * begin()
Definition: uint256.h:58
SigHasLowR
bool SigHasLowR(const secp256k1_ecdsa_signature *sig)
Definition: key.cpp:201
ctx
static secp256k1_context * ctx
Definition: tests.c:42
CPubKey::GetID
CKeyID GetID() const
Get the KeyID of this public key (hash of its serialization)
Definition: pubkey.h:158
CKey::keydata
std::vector< unsigned char, secure_allocator< unsigned char > > keydata
The actual byte data.
Definition: key.h:51
secp256k1_xonly_pubkey
Opaque data structure that holds a parsed and valid "x-only" public key.
Definition: secp256k1_extrakeys.h:22
secp256k1_context_randomize
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize(secp256k1_context *ctx, const unsigned char *seed32) SECP256K1_ARG_NONNULL(1)
Updates the context randomization to protect against side-channel leakage.
Definition: secp256k1.c:761