Bitcoin Core  27.99.0
P2P Digital Currency
key.cpp
Go to the documentation of this file.
1 // Copyright (c) 2009-2022 The Bitcoin Core developers
2 // Copyright (c) 2017 The Zcash developers
3 // Distributed under the MIT software license, see the accompanying
4 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
5 
6 #include <key.h>
7 
8 #include <crypto/common.h>
9 #include <crypto/hmac_sha512.h>
10 #include <hash.h>
11 #include <random.h>
12 
13 #include <secp256k1.h>
14 #include <secp256k1_ellswift.h>
15 #include <secp256k1_extrakeys.h>
16 #include <secp256k1_recovery.h>
17 #include <secp256k1_schnorrsig.h>
18 
20 
38 int ec_seckey_import_der(const secp256k1_context* ctx, unsigned char *out32, const unsigned char *seckey, size_t seckeylen) {
39  const unsigned char *end = seckey + seckeylen;
40  memset(out32, 0, 32);
41  /* sequence header */
42  if (end - seckey < 1 || *seckey != 0x30u) {
43  return 0;
44  }
45  seckey++;
46  /* sequence length constructor */
47  if (end - seckey < 1 || !(*seckey & 0x80u)) {
48  return 0;
49  }
50  ptrdiff_t lenb = *seckey & ~0x80u; seckey++;
51  if (lenb < 1 || lenb > 2) {
52  return 0;
53  }
54  if (end - seckey < lenb) {
55  return 0;
56  }
57  /* sequence length */
58  ptrdiff_t len = seckey[lenb-1] | (lenb > 1 ? seckey[lenb-2] << 8 : 0u);
59  seckey += lenb;
60  if (end - seckey < len) {
61  return 0;
62  }
63  /* sequence element 0: version number (=1) */
64  if (end - seckey < 3 || seckey[0] != 0x02u || seckey[1] != 0x01u || seckey[2] != 0x01u) {
65  return 0;
66  }
67  seckey += 3;
68  /* sequence element 1: octet string, up to 32 bytes */
69  if (end - seckey < 2 || seckey[0] != 0x04u) {
70  return 0;
71  }
72  ptrdiff_t oslen = seckey[1];
73  seckey += 2;
74  if (oslen > 32 || end - seckey < oslen) {
75  return 0;
76  }
77  memcpy(out32 + (32 - oslen), seckey, oslen);
78  if (!secp256k1_ec_seckey_verify(ctx, out32)) {
79  memset(out32, 0, 32);
80  return 0;
81  }
82  return 1;
83 }
84 
95 int ec_seckey_export_der(const secp256k1_context *ctx, unsigned char *seckey, size_t *seckeylen, const unsigned char *key32, bool compressed) {
96  assert(*seckeylen >= CKey::SIZE);
97  secp256k1_pubkey pubkey;
98  size_t pubkeylen = 0;
99  if (!secp256k1_ec_pubkey_create(ctx, &pubkey, key32)) {
100  *seckeylen = 0;
101  return 0;
102  }
103  if (compressed) {
104  static const unsigned char begin[] = {
105  0x30,0x81,0xD3,0x02,0x01,0x01,0x04,0x20
106  };
107  static const unsigned char middle[] = {
108  0xA0,0x81,0x85,0x30,0x81,0x82,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
109  0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
110  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
111  0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
112  0x21,0x02,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
113  0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
114  0x17,0x98,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
115  0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
116  0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x24,0x03,0x22,0x00
117  };
118  unsigned char *ptr = seckey;
119  memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
120  memcpy(ptr, key32, 32); ptr += 32;
121  memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
122  pubkeylen = CPubKey::COMPRESSED_SIZE;
123  secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_COMPRESSED);
124  ptr += pubkeylen;
125  *seckeylen = ptr - seckey;
126  assert(*seckeylen == CKey::COMPRESSED_SIZE);
127  } else {
128  static const unsigned char begin[] = {
129  0x30,0x82,0x01,0x13,0x02,0x01,0x01,0x04,0x20
130  };
131  static const unsigned char middle[] = {
132  0xA0,0x81,0xA5,0x30,0x81,0xA2,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
133  0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
134  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
135  0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
136  0x41,0x04,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
137  0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
138  0x17,0x98,0x48,0x3A,0xDA,0x77,0x26,0xA3,0xC4,0x65,0x5D,0xA4,0xFB,0xFC,0x0E,0x11,
139  0x08,0xA8,0xFD,0x17,0xB4,0x48,0xA6,0x85,0x54,0x19,0x9C,0x47,0xD0,0x8F,0xFB,0x10,
140  0xD4,0xB8,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
141  0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
142  0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x44,0x03,0x42,0x00
143  };
144  unsigned char *ptr = seckey;
145  memcpy(ptr, begin, sizeof(begin)); ptr += sizeof(begin);
146  memcpy(ptr, key32, 32); ptr += 32;
147  memcpy(ptr, middle, sizeof(middle)); ptr += sizeof(middle);
148  pubkeylen = CPubKey::SIZE;
149  secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
150  ptr += pubkeylen;
151  *seckeylen = ptr - seckey;
152  assert(*seckeylen == CKey::SIZE);
153  }
154  return 1;
155 }
156 
157 bool CKey::Check(const unsigned char *vch) {
159 }
160 
161 void CKey::MakeNewKey(bool fCompressedIn) {
162  MakeKeyData();
163  do {
165  } while (!Check(keydata->data()));
166  fCompressed = fCompressedIn;
167 }
168 
170 {
171  assert(keydata);
173 }
174 
176  assert(keydata);
177  CPrivKey seckey;
178  int ret;
179  size_t seckeylen;
180  seckey.resize(SIZE);
181  seckeylen = SIZE;
182  ret = ec_seckey_export_der(secp256k1_context_sign, seckey.data(), &seckeylen, UCharCast(begin()), fCompressed);
183  assert(ret);
184  seckey.resize(seckeylen);
185  return seckey;
186 }
187 
189  assert(keydata);
190  secp256k1_pubkey pubkey;
191  size_t clen = CPubKey::SIZE;
192  CPubKey result;
194  assert(ret);
196  assert(result.size() == clen);
197  assert(result.IsValid());
198  return result;
199 }
200 
201 // Check that the sig has a low R value and will be less than 71 bytes
203 {
204  unsigned char compact_sig[64];
206 
207  // In DER serialization, all values are interpreted as big-endian, signed integers. The highest bit in the integer indicates
208  // its signed-ness; 0 is positive, 1 is negative. When the value is interpreted as a negative integer, it must be converted
209  // to a positive value by prepending a 0x00 byte so that the highest bit is 0. We can avoid this prepending by ensuring that
210  // our highest bit is always 0, and thus we must check that the first byte is less than 0x80.
211  return compact_sig[0] < 0x80;
212 }
213 
214 bool CKey::Sign(const uint256 &hash, std::vector<unsigned char>& vchSig, bool grind, uint32_t test_case) const {
215  if (!keydata)
216  return false;
217  vchSig.resize(CPubKey::SIGNATURE_SIZE);
218  size_t nSigLen = CPubKey::SIGNATURE_SIZE;
219  unsigned char extra_entropy[32] = {0};
220  WriteLE32(extra_entropy, test_case);
222  uint32_t counter = 0;
223  int ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, (!grind && test_case) ? extra_entropy : nullptr);
224 
225  // Grind for low R
226  while (ret && !SigHasLowR(&sig) && grind) {
227  WriteLE32(extra_entropy, ++counter);
229  }
230  assert(ret);
231  secp256k1_ecdsa_signature_serialize_der(secp256k1_context_sign, vchSig.data(), &nSigLen, &sig);
232  vchSig.resize(nSigLen);
233  // Additional verification step to prevent using a potentially corrupted signature
236  assert(ret);
238  assert(ret);
239  return true;
240 }
241 
242 bool CKey::VerifyPubKey(const CPubKey& pubkey) const {
243  if (pubkey.IsCompressed() != fCompressed) {
244  return false;
245  }
246  unsigned char rnd[8];
247  std::string str = "Bitcoin key verification\n";
248  GetRandBytes(rnd);
249  uint256 hash{Hash(str, rnd)};
250  std::vector<unsigned char> vchSig;
251  Sign(hash, vchSig);
252  return pubkey.Verify(hash, vchSig);
253 }
254 
255 bool CKey::SignCompact(const uint256 &hash, std::vector<unsigned char>& vchSig) const {
256  if (!keydata)
257  return false;
258  vchSig.resize(CPubKey::COMPACT_SIGNATURE_SIZE);
259  int rec = -1;
262  assert(ret);
264  assert(ret);
265  assert(rec != -1);
266  vchSig[0] = 27 + rec + (fCompressed ? 4 : 0);
267  // Additional verification step to prevent using a potentially corrupted signature
268  secp256k1_pubkey epk, rpk;
270  assert(ret);
272  assert(ret);
274  assert(ret == 0);
275  return true;
276 }
277 
278 bool CKey::SignSchnorr(const uint256& hash, Span<unsigned char> sig, const uint256* merkle_root, const uint256& aux) const
279 {
280  assert(sig.size() == 64);
281  secp256k1_keypair keypair;
282  if (!secp256k1_keypair_create(secp256k1_context_sign, &keypair, UCharCast(begin()))) return false;
283  if (merkle_root) {
284  secp256k1_xonly_pubkey pubkey;
285  if (!secp256k1_keypair_xonly_pub(secp256k1_context_sign, &pubkey, nullptr, &keypair)) return false;
286  unsigned char pubkey_bytes[32];
287  if (!secp256k1_xonly_pubkey_serialize(secp256k1_context_sign, pubkey_bytes, &pubkey)) return false;
288  uint256 tweak = XOnlyPubKey(pubkey_bytes).ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root);
289  if (!secp256k1_keypair_xonly_tweak_add(secp256k1_context_static, &keypair, tweak.data())) return false;
290  }
291  bool ret = secp256k1_schnorrsig_sign32(secp256k1_context_sign, sig.data(), hash.data(), &keypair, aux.data());
292  if (ret) {
293  // Additional verification step to prevent using a potentially corrupted signature
294  secp256k1_xonly_pubkey pubkey_verify;
295  ret = secp256k1_keypair_xonly_pub(secp256k1_context_static, &pubkey_verify, nullptr, &keypair);
296  ret &= secp256k1_schnorrsig_verify(secp256k1_context_static, sig.data(), hash.begin(), 32, &pubkey_verify);
297  }
298  if (!ret) memory_cleanse(sig.data(), sig.size());
299  memory_cleanse(&keypair, sizeof(keypair));
300  return ret;
301 }
302 
303 bool CKey::Load(const CPrivKey &seckey, const CPubKey &vchPubKey, bool fSkipCheck=false) {
304  MakeKeyData();
305  if (!ec_seckey_import_der(secp256k1_context_sign, (unsigned char*)begin(), seckey.data(), seckey.size())) {
306  ClearKeyData();
307  return false;
308  }
309  fCompressed = vchPubKey.IsCompressed();
310 
311  if (fSkipCheck)
312  return true;
313 
314  return VerifyPubKey(vchPubKey);
315 }
316 
317 bool CKey::Derive(CKey& keyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc) const {
318  assert(IsValid());
319  assert(IsCompressed());
320  std::vector<unsigned char, secure_allocator<unsigned char>> vout(64);
321  if ((nChild >> 31) == 0) {
322  CPubKey pubkey = GetPubKey();
323  assert(pubkey.size() == CPubKey::COMPRESSED_SIZE);
324  BIP32Hash(cc, nChild, *pubkey.begin(), pubkey.begin()+1, vout.data());
325  } else {
326  assert(size() == 32);
327  BIP32Hash(cc, nChild, 0, UCharCast(begin()), vout.data());
328  }
329  memcpy(ccChild.begin(), vout.data()+32, 32);
330  keyChild.Set(begin(), begin() + 32, true);
331  bool ret = secp256k1_ec_seckey_tweak_add(secp256k1_context_sign, (unsigned char*)keyChild.begin(), vout.data());
332  if (!ret) keyChild.ClearKeyData();
333  return ret;
334 }
335 
337 {
338  assert(keydata);
339  assert(ent32.size() == 32);
340  std::array<std::byte, EllSwiftPubKey::size()> encoded_pubkey;
341 
343  UCharCast(encoded_pubkey.data()),
344  keydata->data(),
345  UCharCast(ent32.data()));
346 
347  // Should always succeed for valid keys (asserted above).
348  assert(success);
349  return {encoded_pubkey};
350 }
351 
352 ECDHSecret CKey::ComputeBIP324ECDHSecret(const EllSwiftPubKey& their_ellswift, const EllSwiftPubKey& our_ellswift, bool initiating) const
353 {
354  assert(keydata);
355 
356  ECDHSecret output;
357  // BIP324 uses the initiator as party A, and the responder as party B. Remap the inputs
358  // accordingly:
360  UCharCast(output.data()),
361  UCharCast(initiating ? our_ellswift.data() : their_ellswift.data()),
362  UCharCast(initiating ? their_ellswift.data() : our_ellswift.data()),
363  keydata->data(),
364  initiating ? 0 : 1,
366  nullptr);
367  // Should always succeed for valid keys (assert above).
368  assert(success);
369  return output;
370 }
371 
372 CKey GenerateRandomKey(bool compressed) noexcept
373 {
374  CKey key;
375  key.MakeNewKey(/*fCompressed=*/compressed);
376  return key;
377 }
378 
379 bool CExtKey::Derive(CExtKey &out, unsigned int _nChild) const {
380  if (nDepth == std::numeric_limits<unsigned char>::max()) return false;
381  out.nDepth = nDepth + 1;
382  CKeyID id = key.GetPubKey().GetID();
383  memcpy(out.vchFingerprint, &id, 4);
384  out.nChild = _nChild;
385  return key.Derive(out.key, out.chaincode, _nChild, chaincode);
386 }
387 
389 {
390  static const unsigned char hashkey[] = {'B','i','t','c','o','i','n',' ','s','e','e','d'};
391  std::vector<unsigned char, secure_allocator<unsigned char>> vout(64);
392  CHMAC_SHA512{hashkey, sizeof(hashkey)}.Write(UCharCast(seed.data()), seed.size()).Finalize(vout.data());
393  key.Set(vout.data(), vout.data() + 32, true);
394  memcpy(chaincode.begin(), vout.data() + 32, 32);
395  nDepth = 0;
396  nChild = 0;
397  memset(vchFingerprint, 0, sizeof(vchFingerprint));
398 }
399 
401  CExtPubKey ret;
402  ret.nDepth = nDepth;
403  memcpy(ret.vchFingerprint, vchFingerprint, 4);
404  ret.nChild = nChild;
405  ret.pubkey = key.GetPubKey();
406  ret.chaincode = chaincode;
407  return ret;
408 }
409 
410 void CExtKey::Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const {
411  code[0] = nDepth;
412  memcpy(code+1, vchFingerprint, 4);
413  WriteBE32(code+5, nChild);
414  memcpy(code+9, chaincode.begin(), 32);
415  code[41] = 0;
416  assert(key.size() == 32);
417  memcpy(code+42, key.begin(), 32);
418 }
419 
420 void CExtKey::Decode(const unsigned char code[BIP32_EXTKEY_SIZE]) {
421  nDepth = code[0];
422  memcpy(vchFingerprint, code+1, 4);
423  nChild = ReadBE32(code+5);
424  memcpy(chaincode.begin(), code+9, 32);
425  key.Set(code+42, code+BIP32_EXTKEY_SIZE, true);
426  if ((nDepth == 0 && (nChild != 0 || ReadLE32(vchFingerprint) != 0)) || code[41] != 0) key = CKey();
427 }
428 
430  CKey key = GenerateRandomKey();
431  CPubKey pubkey = key.GetPubKey();
432  return key.VerifyPubKey(pubkey);
433 }
434 
435 void ECC_Start() {
436  assert(secp256k1_context_sign == nullptr);
437 
439  assert(ctx != nullptr);
440 
441  {
442  // Pass in a random blinding seed to the secp256k1 context.
443  std::vector<unsigned char, secure_allocator<unsigned char>> vseed(32);
444  GetRandBytes(vseed);
445  bool ret = secp256k1_context_randomize(ctx, vseed.data());
446  assert(ret);
447  }
448 
450 }
451 
452 void ECC_Stop() {
454  secp256k1_context_sign = nullptr;
455 
456  if (ctx) {
458  }
459 }
int ret
A hasher class for HMAC-SHA-512.
Definition: hmac_sha512.h:15
CHMAC_SHA512 & Write(const unsigned char *data, size_t len)
Definition: hmac_sha512.h:24
An encapsulated private key.
Definition: key.h:33
bool SignSchnorr(const uint256 &hash, Span< unsigned char > sig, const uint256 *merkle_root, const uint256 &aux) const
Create a BIP-340 Schnorr signature, for the xonly-pubkey corresponding to *this, optionally tweaked b...
Definition: key.cpp:278
bool Negate()
Negate private key.
Definition: key.cpp:169
static const unsigned int SIZE
secp256k1:
Definition: key.h:38
void MakeKeyData()
Definition: key.h:61
void ClearKeyData()
Definition: key.h:66
unsigned int size() const
Simple read-only vector-like interface.
Definition: key.h:113
bool IsValid() const
Check whether this private key is valid.
Definition: key.h:119
bool Sign(const uint256 &hash, std::vector< unsigned char > &vchSig, bool grind=true, uint32_t test_case=0) const
Create a DER-serialized signature.
Definition: key.cpp:214
ECDHSecret ComputeBIP324ECDHSecret(const EllSwiftPubKey &their_ellswift, const EllSwiftPubKey &our_ellswift, bool initiating) const
Compute a BIP324-style ECDH shared secret.
Definition: key.cpp:352
CPrivKey GetPrivKey() const
Convert the private key to a CPrivKey (serialized OpenSSL private key data).
Definition: key.cpp:175
static const unsigned int COMPRESSED_SIZE
Definition: key.h:39
bool IsCompressed() const
Check whether the public key corresponding to this private key is (to be) compressed.
Definition: key.h:122
void MakeNewKey(bool fCompressed)
Generate a new private key using a cryptographic PRNG.
Definition: key.cpp:161
bool fCompressed
Whether the public key corresponding to this private key is (to be) compressed.
Definition: key.h:53
CPubKey GetPubKey() const
Compute the public key from a private key.
Definition: key.cpp:188
void Set(const T pbegin, const T pend, bool fCompressedIn)
Initialize using begin and end iterators to byte data.
Definition: key.h:99
bool VerifyPubKey(const CPubKey &vchPubKey) const
Verify thoroughly whether a private key and a public key match.
Definition: key.cpp:242
EllSwiftPubKey EllSwiftCreate(Span< const std::byte > entropy) const
Create an ellswift-encoded public key for this key, with specified entropy.
Definition: key.cpp:336
bool Load(const CPrivKey &privkey, const CPubKey &vchPubKey, bool fSkipCheck)
Load private key and check that public key matches.
Definition: key.cpp:303
static bool Check(const unsigned char *vch)
Check whether the 32-byte array pointed to by vch is valid keydata.
Definition: key.cpp:157
const std::byte * begin() const
Definition: key.h:115
bool Derive(CKey &keyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode &cc) const
Derive BIP32 child key.
Definition: key.cpp:317
secure_unique_ptr< KeyType > keydata
The actual byte data. nullptr for invalid keys.
Definition: key.h:56
bool SignCompact(const uint256 &hash, std::vector< unsigned char > &vchSig) const
Create a compact signature (65 bytes), which allows reconstructing the used public key.
Definition: key.cpp:255
A reference to a CKey: the Hash160 of its serialized public key.
Definition: pubkey.h:24
An encapsulated public key.
Definition: pubkey.h:34
bool IsCompressed() const
Check whether this is a compressed public key.
Definition: pubkey.h:204
CKeyID GetID() const
Get the KeyID of this public key (hash of its serialization)
Definition: pubkey.h:164
static constexpr unsigned int COMPRESSED_SIZE
Definition: pubkey.h:40
bool IsValid() const
Definition: pubkey.h:189
bool Verify(const uint256 &hash, const std::vector< unsigned char > &vchSig) const
Verify a DER signature (~72 bytes).
Definition: pubkey.cpp:267
static constexpr unsigned int SIZE
secp256k1:
Definition: pubkey.h:39
unsigned int size() const
Simple read-only vector-like interface to the pubkey data.
Definition: pubkey.h:112
const unsigned char * begin() const
Definition: pubkey.h:114
static constexpr unsigned int SIGNATURE_SIZE
Definition: pubkey.h:41
static constexpr unsigned int COMPACT_SIGNATURE_SIZE
Definition: pubkey.h:42
A Span is an object that can refer to a contiguous sequence of objects.
Definition: span.h:98
constexpr std::size_t size() const noexcept
Definition: span.h:187
constexpr C * data() const noexcept
Definition: span.h:174
uint256 ComputeTapTweakHash(const uint256 *merkle_root) const
Compute the Taproot tweak as specified in BIP341, with *this as internal key:
Definition: pubkey.cpp:230
constexpr bool IsNull() const
Definition: uint256.h:42
constexpr const unsigned char * data() const
Definition: uint256.h:65
constexpr unsigned char * begin()
Definition: uint256.h:68
256-bit opaque blob.
Definition: uint256.h:106
void memory_cleanse(void *ptr, size_t len)
Secure overwrite a buffer (possibly containing secret data) with zero-bytes.
Definition: cleanse.cpp:14
static uint32_t ReadLE32(const unsigned char *ptr)
Definition: common.h:20
static void WriteBE32(unsigned char *ptr, uint32_t x)
Definition: common.h:73
static void WriteLE32(unsigned char *ptr, uint32_t x)
Definition: common.h:40
static uint32_t ReadBE32(const unsigned char *ptr)
Definition: common.h:59
void BIP32Hash(const ChainCode &chainCode, unsigned int nChild, unsigned char header, const unsigned char data[32], unsigned char output[64])
Definition: hash.cpp:71
uint256 Hash(const T &in1)
Compute the 256-bit hash of an object.
Definition: hash.h:75
int ec_seckey_export_der(const secp256k1_context *ctx, unsigned char *seckey, size_t *seckeylen, const unsigned char *key32, bool compressed)
This serializes to a DER encoding of the ECPrivateKey type from section C.4 of SEC 1 https://www....
Definition: key.cpp:95
static secp256k1_context * secp256k1_context_sign
Definition: key.cpp:19
bool SigHasLowR(const secp256k1_ecdsa_signature *sig)
Definition: key.cpp:202
int ec_seckey_import_der(const secp256k1_context *ctx, unsigned char *out32, const unsigned char *seckey, size_t seckeylen)
These functions are taken from the libsecp256k1 distribution and are very ugly.
Definition: key.cpp:38
bool ECC_InitSanityCheck()
Check that required EC support is available at runtime.
Definition: key.cpp:429
void ECC_Start()
Initialize the elliptic curve support.
Definition: key.cpp:435
CKey GenerateRandomKey(bool compressed) noexcept
Definition: key.cpp:372
void ECC_Stop()
Deinitialize the elliptic curve support.
Definition: key.cpp:452
std::vector< unsigned char, secure_allocator< unsigned char > > CPrivKey
CPrivKey is a serialized private key, with all parameters included (SIZE bytes)
Definition: key.h:23
std::array< std::byte, ECDH_SECRET_SIZE > ECDHSecret
Definition: key.h:29
const unsigned int BIP32_EXTKEY_SIZE
Definition: pubkey.h:19
void GetRandBytes(Span< unsigned char > bytes) noexcept
Overall design of the RNG and entropy sources.
Definition: random.cpp:638
void GetStrongRandBytes(Span< unsigned char > bytes) noexcept
Gather entropy from various sources, feed it into the internal PRNG, and generate random data using i...
Definition: random.cpp:639
SECP256K1_API void secp256k1_context_destroy(secp256k1_context *ctx) SECP256K1_ARG_NONNULL(1)
Destroy a secp256k1 context object (created in dynamically allocated memory).
Definition: secp256k1.c:186
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize(secp256k1_context *ctx, const unsigned char *seed32) SECP256K1_ARG_NONNULL(1)
Randomizes the context to provide enhanced protection against side-channel leakage.
Definition: secp256k1.c:750
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_negate(const secp256k1_context *ctx, unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Negates a secret key in place.
Definition: secp256k1.c:613
SECP256K1_API int secp256k1_ec_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey *pubkey, unsigned int flags) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize a pubkey object into a serialized byte sequence.
Definition: secp256k1.c:290
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_cmp(const secp256k1_context *ctx, const secp256k1_pubkey *pubkey1, const secp256k1_pubkey *pubkey2) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compare two public keys using lexicographic (of compressed serialization) order.
Definition: secp256k1.c:313
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify(const secp256k1_context *ctx, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Verify an ECDSA secret key.
Definition: secp256k1.c:572
SECP256K1_API int secp256k1_ecdsa_sign(const secp256k1_context *ctx, secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create an ECDSA signature.
Definition: secp256k1.c:558
#define SECP256K1_CONTEXT_NONE
Context flags to pass to secp256k1_context_create, secp256k1_context_preallocated_size,...
Definition: secp256k1.h:205
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the public key for a secret key.
Definition: secp256k1.c:595
SECP256K1_API secp256k1_context * secp256k1_context_create(unsigned int flags) SECP256K1_WARN_UNUSED_RESULT
Create a secp256k1 context object (in dynamically allocated memory).
Definition: secp256k1.c:140
#define SECP256K1_EC_COMPRESSED
Flag to pass to secp256k1_ec_pubkey_serialize.
Definition: secp256k1.h:215
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify(const secp256k1_context *ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const secp256k1_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Verify an ECDSA signature.
Definition: secp256k1.c:444
#define SECP256K1_EC_UNCOMPRESSED
Definition: secp256k1.h:216
SECP256K1_API const secp256k1_nonce_function secp256k1_nonce_function_rfc6979
An implementation of RFC6979 (using HMAC-SHA256) as nonce generation function.
Definition: secp256k1.h:636
SECP256K1_API int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context *ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize an ECDSA signature in DER format.
Definition: secp256k1.c:400
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_tweak_add(const secp256k1_context *ctx, unsigned char *seckey, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a secret key by adding tweak to it.
Definition: secp256k1.c:659
SECP256K1_API int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context *ctx, unsigned char *output64, const secp256k1_ecdsa_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Serialize an ECDSA signature in compact (64 byte) format.
Definition: secp256k1.c:412
SECP256K1_API const secp256k1_context * secp256k1_context_static
A built-in constant secp256k1 context object with static storage duration, to be used in conjunction ...
Definition: secp256k1.h:236
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ellswift_create(const secp256k1_context *ctx, unsigned char *ell64, const unsigned char *seckey32, const unsigned char *auxrnd32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute an ElligatorSwift public key for a secret key.
Definition: main_impl.h:450
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ellswift_xdh(const secp256k1_context *ctx, unsigned char *output, const unsigned char *ell_a64, const unsigned char *ell_b64, const unsigned char *seckey32, int party, secp256k1_ellswift_xdh_hash_function hashfp, void *data) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(7)
Given a private key, and ElligatorSwift public keys sent in both directions, compute a shared secret ...
Definition: main_impl.h:549
SECP256K1_API const secp256k1_ellswift_xdh_hash_function secp256k1_ellswift_xdh_hash_function_bip324
An implementation of an secp256k1_ellswift_xdh_hash_function compatible with BIP324.
SECP256K1_API int secp256k1_xonly_pubkey_serialize(const secp256k1_context *ctx, unsigned char *output32, const secp256k1_xonly_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Serialize an xonly_pubkey object into a 32-byte sequence.
Definition: main_impl.h:44
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_create(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the keypair for a secret key.
Definition: main_impl.h:196
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_tweak_add(const secp256k1_context *ctx, secp256k1_keypair *keypair, const unsigned char *tweak32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a keypair by adding tweak32 to the secret key and updating the public key accordingly.
Definition: main_impl.h:255
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_keypair_xonly_pub(const secp256k1_context *ctx, secp256k1_xonly_pubkey *pubkey, int *pk_parity, const secp256k1_keypair *keypair) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4)
Get the x-only public key from a keypair.
Definition: main_impl.h:234
SECP256K1_API int secp256k1_ecdsa_recoverable_signature_serialize_compact(const secp256k1_context *ctx, unsigned char *output64, int *recid, const secp256k1_ecdsa_recoverable_signature *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize an ECDSA signature in compact format (64 bytes + recovery id).
Definition: main_impl.h:60
SECP256K1_API int secp256k1_ecdsa_sign_recoverable(const secp256k1_context *ctx, secp256k1_ecdsa_recoverable_signature *sig, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create a recoverable ECDSA signature.
Definition: main_impl.h:123
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_recover(const secp256k1_context *ctx, secp256k1_pubkey *pubkey, const secp256k1_ecdsa_recoverable_signature *sig, const unsigned char *msghash32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Recover an ECDSA public key from a signature.
Definition: main_impl.h:137
SECP256K1_API int secp256k1_schnorrsig_sign32(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *msg32, const secp256k1_keypair *keypair, const unsigned char *aux_rand32) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create a Schnorr signature.
Definition: main_impl.h:195
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_verify(const secp256k1_context *ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_xonly_pubkey *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(5)
Verify a Schnorr signature.
Definition: main_impl.h:219
unsigned char * UCharCast(char *c)
Definition: span.h:288
Definition: key.h:210
unsigned char vchFingerprint[4]
Definition: key.h:212
CExtPubKey Neuter() const
Definition: key.cpp:400
bool Derive(CExtKey &out, unsigned int nChild) const
Definition: key.cpp:379
void Decode(const unsigned char code[BIP32_EXTKEY_SIZE])
Definition: key.cpp:420
CKey key
Definition: key.h:215
void Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const
Definition: key.cpp:410
unsigned char nDepth
Definition: key.h:211
ChainCode chaincode
Definition: key.h:214
unsigned int nChild
Definition: key.h:213
void SetSeed(Span< const std::byte > seed)
Definition: key.cpp:388
An ElligatorSwift-encoded public key.
Definition: pubkey.h:305
static constexpr size_t size()
Definition: pubkey.h:322
const std::byte * data() const
Definition: pubkey.h:321
Opaque data structured that holds a parsed ECDSA signature, supporting pubkey recovery.
Opaque data structured that holds a parsed ECDSA signature.
Definition: secp256k1.h:87
Opaque data structure that holds a keypair consisting of a secret and a public key.
Opaque data structure that holds a parsed and valid public key.
Definition: secp256k1.h:74
Opaque data structure that holds a parsed and valid "x-only" public key.
assert(!tx.IsCoinBase())