pubkey.h

Go to the documentation of this file.

// Copyright (c) 2009-2010 Satoshi Nakamoto
// Copyright (c) 2009-present The Bitcoin Core developers
// Copyright (c) 2017 The Zcash developers
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
#ifndef BITCOIN_PUBKEY_H
#define BITCOIN_PUBKEY_H
 
#include <hash.h>
#include <serialize.h>
#include <span.h>
#include <uint256.h>
 
#include <array>
#include <cassert>
#include <cstring>
#include <optional>
#include <span>
#include <vector>
 
inline constexpr unsigned int BIP32_EXTKEY_SIZE = 74;
inline constexpr unsigned int BIP32_EXTKEY_WITH_VERSION_SIZE = 78;
 
using KeyFingerprint = std::array<unsigned char, 4>;
 
class CKeyID : public uint160
{
public:
    CKeyID() : uint160() {}
    explicit CKeyID(const uint160& in) : uint160(in) {}
    KeyFingerprint fingerprint() const
    {
        KeyFingerprint ret;
        std::copy_n(begin(), ret.size(), ret.begin());
        return ret;
    }
};
 
class CPubKey
{
public:
    static constexpr unsigned int SIZE                   = 65;
    static constexpr unsigned int COMPRESSED_SIZE        = 33;
    static constexpr unsigned int SIGNATURE_SIZE         = 72;
    static constexpr unsigned int COMPACT_SIGNATURE_SIZE = 65;
    static_assert(
        SIZE >= COMPRESSED_SIZE,
        "COMPRESSED_SIZE is larger than SIZE");
 
private:
 
    unsigned char vch[SIZE];
 
    unsigned int static GetLen(unsigned char chHeader)
    {
        if (chHeader == 2 || chHeader == 3)
            return COMPRESSED_SIZE;
        if (chHeader == 4 || chHeader == 6 || chHeader == 7)
            return SIZE;
        return 0;
    }
 
    void Invalidate()
    {
        vch[0] = 0xFF;
    }
 
public:
 
    bool static ValidSize(const std::vector<unsigned char> &vch) {
      return vch.size() > 0 && GetLen(vch[0]) == vch.size();
    }
 
    CPubKey()
    {
        Invalidate();
    }
 
    template <typename T>
    void Set(const T pbegin, const T pend)
    {
        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
        if (len && len == (pend - pbegin))
            memcpy(vch, (unsigned char*)&pbegin[0], len);
        else
            Invalidate();
    }
 
    template <typename T>
    CPubKey(const T pbegin, const T pend)
    {
        Set(pbegin, pend);
    }
 
    explicit CPubKey(std::span<const uint8_t> _vch)
    {
        Set(_vch.begin(), _vch.end());
    }
 
    unsigned int size() const { return GetLen(vch[0]); }
    const unsigned char* data() const { return vch; }
    const unsigned char* begin() const { return vch; }
    const unsigned char* end() const { return vch + size(); }
    const unsigned char& operator[](unsigned int pos) const { return vch[pos]; }
 
    friend bool operator==(const CPubKey& a, const CPubKey& b)
    {
        return a.vch[0] == b.vch[0] &&
               memcmp(a.vch, b.vch, a.size()) == 0;
    }
    friend bool operator<(const CPubKey& a, const CPubKey& b)
    {
        return a.vch[0] < b.vch[0] ||
               (a.vch[0] == b.vch[0] && memcmp(a.vch, b.vch, a.size()) < 0);
    }
    friend bool operator>(const CPubKey& a, const CPubKey& b)
    {
        return a.vch[0] > b.vch[0] ||
               (a.vch[0] == b.vch[0] && memcmp(a.vch, b.vch, a.size()) > 0);
    }
 
    template <typename Stream>
    void Serialize(Stream& s) const
    {
        unsigned int len = size();
        ::WriteCompactSize(s, len);
        s << std::span{vch, len};
    }
    template <typename Stream>
    void Unserialize(Stream& s)
    {
        const unsigned int len(::ReadCompactSize(s));
        if (len <= SIZE) {
            s >> std::span{vch, len};
            if (len != size()) {
                Invalidate();
            }
        } else {
            // invalid pubkey, skip available data
            s.ignore(len);
            Invalidate();
        }
    }
 
    CKeyID GetID() const
    {
        return CKeyID(Hash160(std::span{vch}.first(size())));
    }
 
    uint256 GetHash() const
    {
        return Hash(std::span{vch}.first(size()));
    }
 
    /*
     * Check syntactic correctness.
     *
     * When setting a pubkey (Set()) or deserializing fails (its header bytes
     * don't match the length of the data), the size is set to 0. Thus,
     * by checking size, one can observe whether Set() or deserialization has
     * failed.
     *
     * This does not check for more than that. In particular, it does not verify
     * that the coordinates correspond to a point on the curve (see IsFullyValid()
     * for that instead).
     *
     * Note that this is consensus critical as CheckECDSASignature() calls it!
     */
    bool IsValid() const
    {
        return size() > 0;
    }
 
    bool IsValidNonHybrid() const noexcept
    {
        return size() > 0 && (vch[0] == 0x02 || vch[0] == 0x03 || vch[0] == 0x04);
    }
 
    bool IsFullyValid() const;
 
    bool IsCompressed() const
    {
        return size() == COMPRESSED_SIZE;
    }
 
    bool Verify(const uint256& hash, const std::vector<unsigned char>& vchSig) const;
 
    static bool CheckLowS(const std::vector<unsigned char>& vchSig);
 
    bool RecoverCompact(const uint256& hash, const std::vector<unsigned char>& vchSig);
 
    bool Decompress();
 
    [[nodiscard]] bool Derive(CPubKey& pubkeyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc, uint256* bip32_tweak_out = nullptr) const;
};
 
class XOnlyPubKey
{
private:
    uint256 m_keydata;
 
public:
    static const XOnlyPubKey NUMS_H;
 
    XOnlyPubKey() = default;
 
    XOnlyPubKey(const XOnlyPubKey&) = default;
    XOnlyPubKey& operator=(const XOnlyPubKey&) = default;
 
    bool IsFullyValid() const;
 
    bool IsNull() const { return m_keydata.IsNull(); }
 
    constexpr explicit XOnlyPubKey(std::span<const unsigned char> bytes) : m_keydata{bytes} {}
 
    explicit XOnlyPubKey(const CPubKey& pubkey) : XOnlyPubKey(std::span{pubkey}.subspan(1, 32)) {}
 
    bool VerifySchnorr(const uint256& msg, std::span<const unsigned char> sigbytes) const;
 
    uint256 ComputeTapTweakHash(const uint256* merkle_root) const;
 
    bool CheckTapTweak(const XOnlyPubKey& internal, const uint256& merkle_root, bool parity) const;
 
    std::optional<std::pair<XOnlyPubKey, bool>> CreateTapTweak(const uint256* merkle_root) const;
 
    std::vector<CKeyID> GetKeyIDs() const;
    std::vector<CPubKey> GetCPubKeys() const;
 
    CPubKey GetEvenCorrespondingCPubKey() const;
 
    const unsigned char& operator[](int pos) const { return *(m_keydata.begin() + pos); }
    static constexpr size_t size() { return decltype(m_keydata)::size(); }
    const unsigned char* data() const { return m_keydata.begin(); }
    const unsigned char* begin() const { return m_keydata.begin(); }
    const unsigned char* end() const { return m_keydata.end(); }
    unsigned char* data() { return m_keydata.begin(); }
    unsigned char* begin() { return m_keydata.begin(); }
    unsigned char* end() { return m_keydata.end(); }
    bool operator==(const XOnlyPubKey& other) const { return m_keydata == other.m_keydata; }
    bool operator<(const XOnlyPubKey& other) const { return m_keydata < other.m_keydata; }
 
    SERIALIZE_METHODS(XOnlyPubKey, obj) { READWRITE(obj.m_keydata); }
};
 
struct EllSwiftPubKey
{
private:
    static constexpr size_t SIZE = 64;
    std::array<std::byte, SIZE> m_pubkey;
 
public:
    EllSwiftPubKey() noexcept = default;
 
    EllSwiftPubKey(std::span<const std::byte> ellswift) noexcept;
 
    CPubKey Decode() const;
 
    // Read-only access for serialization.
    const std::byte* data() const { return m_pubkey.data(); }
    static constexpr size_t size() { return SIZE; }
    auto begin() const { return m_pubkey.cbegin(); }
    auto end() const { return m_pubkey.cend(); }
 
    bool friend operator==(const EllSwiftPubKey& a, const EllSwiftPubKey& b)
    {
        return a.m_pubkey == b.m_pubkey;
    }
};
 
struct CExtPubKey {
    unsigned char version[4];
    unsigned char nDepth;
    KeyFingerprint fingerprint;
    unsigned int nChild;
    ChainCode chaincode;
    CPubKey pubkey;
 
    friend bool operator==(const CExtPubKey &a, const CExtPubKey &b)
    {
        return a.nDepth == b.nDepth &&
            a.fingerprint == b.fingerprint &&
            a.nChild == b.nChild &&
            a.chaincode == b.chaincode &&
            a.pubkey == b.pubkey;
    }
 
    friend bool operator<(const CExtPubKey &a, const CExtPubKey &b)
    {
        if (a.pubkey < b.pubkey) {
            return true;
        } else if (a.pubkey > b.pubkey) {
            return false;
        }
        return a.chaincode < b.chaincode;
    }
 
    KeyFingerprint id_key_fingerprint() const
    {
        return pubkey.GetID().fingerprint();
    }
 
    template <typename Stream>
    void Serialize(Stream& s) const
    {
        assert(pubkey.size() == CPubKey::COMPRESSED_SIZE);
        s << nDepth << fingerprint << Using<BigEndianFormatter<4>>(nChild) << chaincode << std::span{pubkey.data(), CPubKey::COMPRESSED_SIZE};
    }
    template <typename Stream>
    void Unserialize(Stream& s)
    {
        std::array<unsigned char, CPubKey::COMPRESSED_SIZE> ser_pubkey;
        s >> nDepth >> fingerprint >> Using<BigEndianFormatter<4>>(nChild) >> chaincode >> ser_pubkey;
        pubkey.Set(ser_pubkey.begin(), ser_pubkey.end());
        if ((nDepth == 0 && (nChild != 0 || fingerprint != KeyFingerprint{})) || !pubkey.IsFullyValid()) pubkey = CPubKey();
    }
    [[nodiscard]] bool Derive(CExtPubKey& out, unsigned int nChild, uint256* bip32_tweak_out = nullptr) const;
};
 
#endif // BITCOIN_PUBKEY_H