|
@ -13,9 +13,14 @@ var networks = require('./networks') |
|
|
var sec = require('./sec') |
|
|
var sec = require('./sec') |
|
|
var ecparams = sec("secp256k1") |
|
|
var ecparams = sec("secp256k1") |
|
|
|
|
|
|
|
|
function HmacSHA512(buffer, secret) { |
|
|
function HmacSHA512(data, secret) { |
|
|
var words = convert.bytesToWordArray(buffer) |
|
|
assert(Buffer.isBuffer(data)) |
|
|
var hash = CJS.HmacSHA512(words, secret) |
|
|
assert(Buffer.isBuffer(secret)) |
|
|
|
|
|
|
|
|
|
|
|
var dataWords = convert.bytesToWordArray(data) |
|
|
|
|
|
var secretWords = convert.bytesToWordArray(secret) |
|
|
|
|
|
|
|
|
|
|
|
var hash = CJS.HmacSHA512(dataWords, secretWords) |
|
|
|
|
|
|
|
|
return new Buffer(convert.wordArrayToBytes(hash)) |
|
|
return new Buffer(convert.wordArrayToBytes(hash)) |
|
|
} |
|
|
} |
|
@ -23,20 +28,26 @@ function HmacSHA512(buffer, secret) { |
|
|
function HDWallet(seed, networkString) { |
|
|
function HDWallet(seed, networkString) { |
|
|
if (seed == undefined) return; // FIXME: Boo, should be stricter
|
|
|
if (seed == undefined) return; // FIXME: Boo, should be stricter
|
|
|
|
|
|
|
|
|
var I = HmacSHA512(seed, 'Bitcoin seed') |
|
|
|
|
|
this.chaincode = I.slice(32) |
|
|
|
|
|
this.network = networkString || 'bitcoin' |
|
|
this.network = networkString || 'bitcoin' |
|
|
|
|
|
|
|
|
if(!networks.hasOwnProperty(this.network)) { |
|
|
if(!networks.hasOwnProperty(this.network)) { |
|
|
throw new Error("Unknown network: " + this.network) |
|
|
throw new Error("Unknown network: " + this.network) |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
this.priv = ECKey.fromBuffer(I.slice(0, 32), true) |
|
|
var I = HmacSHA512(seed, HDWallet.MASTER_SECRET) |
|
|
|
|
|
var IL = I.slice(0, 32) |
|
|
|
|
|
var IR = I.slice(32) |
|
|
|
|
|
|
|
|
|
|
|
// In case IL is 0 or >= n, the master key is invalid (handled by ECKey.fromBuffer)
|
|
|
|
|
|
this.priv = ECKey.fromBuffer(IL, true) |
|
|
this.pub = this.priv.pub |
|
|
this.pub = this.priv.pub |
|
|
this.index = 0 |
|
|
|
|
|
|
|
|
this.chaincode = IR |
|
|
this.depth = 0 |
|
|
this.depth = 0 |
|
|
|
|
|
this.index = 0 |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
HDWallet.MASTER_SECRET = new Buffer('Bitcoin seed') |
|
|
HDWallet.HIGHEST_BIT = 0x80000000 |
|
|
HDWallet.HIGHEST_BIT = 0x80000000 |
|
|
HDWallet.LENGTH = 78 |
|
|
HDWallet.LENGTH = 78 |
|
|
|
|
|
|
|
@ -178,69 +189,79 @@ HDWallet.prototype.toBase58 = function(priv) { |
|
|
])) |
|
|
])) |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
HDWallet.prototype.derive = function(i) { |
|
|
// https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#child-key-derivation-ckd-functions
|
|
|
var iBuffer = new Buffer(4) |
|
|
HDWallet.prototype.derive = function(index) { |
|
|
iBuffer.writeUInt32BE(i, 0) |
|
|
var isHardened = index >= HDWallet.HIGHEST_BIT |
|
|
|
|
|
var indexBuffer = new Buffer(4) |
|
|
|
|
|
indexBuffer.writeUInt32BE(index, 0) |
|
|
|
|
|
|
|
|
var cPar = this.chaincode |
|
|
var data |
|
|
var usePriv = i >= HDWallet.HIGHEST_BIT |
|
|
|
|
|
|
|
|
|
|
|
var I |
|
|
// Hardened child
|
|
|
if (usePriv) { |
|
|
if (isHardened) { |
|
|
assert(this.priv, 'Missing private key') |
|
|
assert(this.priv, 'Could not derive hardened child key') |
|
|
|
|
|
|
|
|
// If 1, private derivation is used:
|
|
|
// data = 0x00 || ser256(kpar) || ser32(index)
|
|
|
// let I = HMAC-SHA512(Key = cpar, Data = 0x00 || kpar || i) [Note:]
|
|
|
data = Buffer.concat([ |
|
|
var kPar = this.priv.toBuffer().slice(0, 32) |
|
|
this.priv.D.toBuffer(33), |
|
|
iBuffer = Buffer.concat([new Buffer([0]), kPar, iBuffer], 37) |
|
|
indexBuffer |
|
|
|
|
|
]) |
|
|
|
|
|
|
|
|
// FIXME: Dislikes buffers
|
|
|
// Normal child
|
|
|
I = HmacFromBytesToBytes(CJS.algo.SHA512, Array.prototype.slice.call(iBuffer), cPar) |
|
|
|
|
|
} else { |
|
|
} else { |
|
|
// If 0, public derivation is used:
|
|
|
// data = serP(point(kpar)) || ser32(index)
|
|
|
// let I = HMAC-SHA512(Key = cpar, Data = χ(kpar*G) || i)
|
|
|
// = serP(Kpar) || ser32(index)
|
|
|
var KPar = this.pub.toBuffer() |
|
|
data = Buffer.concat([ |
|
|
iBuffer = Buffer.concat([KPar, iBuffer]) |
|
|
this.pub.toBuffer(), |
|
|
|
|
|
indexBuffer |
|
|
// FIXME: Dislikes buffers
|
|
|
]) |
|
|
I = HmacFromBytesToBytes(CJS.algo.SHA512, Array.prototype.slice.call(iBuffer), cPar) |
|
|
|
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
// FIXME: Boo, CSJ.algo.SHA512 uses byte arrays
|
|
|
var I = HmacSHA512(data, this.chaincode) |
|
|
I = new Buffer(I) |
|
|
var IL = I.slice(0, 32) |
|
|
|
|
|
var IR = I.slice(32) |
|
|
// Split I = IL || IR into two 32-byte sequences, IL and IR.
|
|
|
|
|
|
var ILb = I.slice(0, 32) |
|
|
|
|
|
, IRb = I.slice(32) |
|
|
|
|
|
|
|
|
|
|
|
var hd = new HDWallet() |
|
|
var hd = new HDWallet() |
|
|
hd.network = this.network |
|
|
var pIL = BigInteger.fromBuffer(IL) |
|
|
|
|
|
|
|
|
var IL = BigInteger.fromBuffer(ILb) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// Private parent key -> private child key
|
|
|
if (this.priv) { |
|
|
if (this.priv) { |
|
|
// ki = IL + kpar (mod n).
|
|
|
// ki = parse256(IL) + kpar (mod n)
|
|
|
var ki = IL.add(this.priv.D).mod(ecparams.getN()) |
|
|
var ki = pIL.add(this.priv.D).mod(ecparams.getN()) |
|
|
|
|
|
|
|
|
|
|
|
// In case parse256(IL) >= n or ki == 0, one should proceed with the next value for i
|
|
|
|
|
|
if (pIL.compareTo(ecparams.getN()) >= 0 || ki.signum() === 0) { |
|
|
|
|
|
return this.derive(index + 1) |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
hd.priv = new ECKey(ki, true) |
|
|
hd.priv = new ECKey(ki, true) |
|
|
hd.pub = hd.priv.pub |
|
|
hd.pub = hd.priv.pub |
|
|
|
|
|
|
|
|
|
|
|
// Public parent key -> public child key
|
|
|
} else { |
|
|
} else { |
|
|
// Ki = (IL + kpar)*G = IL*G + Kpar
|
|
|
// Ki = point(parse256(IL)) + Kpar
|
|
|
var Ki = ecparams.getG().multiply(IL).add(this.pub.Q) |
|
|
// = G*IL + Kpar
|
|
|
|
|
|
var Ki = ecparams.getG().multiply(pIL).add(this.pub.Q) |
|
|
|
|
|
|
|
|
|
|
|
// In case parse256(IL) >= n or Ki is the point at infinity, one should proceed with the next value for i
|
|
|
|
|
|
if (pIL.compareTo(ecparams.getN()) >= 0 || Ki.isInfinity()) { |
|
|
|
|
|
return this.derive(index + 1) |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
hd.pub = new ECPubKey(Ki, true) |
|
|
hd.pub = new ECPubKey(Ki, true) |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
// ci = IR.
|
|
|
hd.chaincode = IR |
|
|
hd.chaincode = IRb |
|
|
|
|
|
hd.parentFingerprint = this.getFingerprint().readUInt32BE(0) |
|
|
|
|
|
hd.depth = this.depth + 1 |
|
|
hd.depth = this.depth + 1 |
|
|
hd.index = i |
|
|
hd.network = this.network |
|
|
hd.pub.compressed = true |
|
|
hd.parentFingerprint = this.getFingerprint().readUInt32BE(0) |
|
|
|
|
|
hd.index = index |
|
|
|
|
|
|
|
|
return hd |
|
|
return hd |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
HDWallet.prototype.derivePrivate = function(index) { |
|
|
HDWallet.prototype.derivePrivate = function(index) { |
|
|
|
|
|
// Only derives hardened private keys by default
|
|
|
return this.derive(index + HDWallet.HIGHEST_BIT) |
|
|
return this.derive(index + HDWallet.HIGHEST_BIT) |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
@ -250,10 +271,4 @@ HDWallet.prototype.getKeyVersion = function() { |
|
|
|
|
|
|
|
|
HDWallet.prototype.toString = HDWallet.prototype.toBase58 |
|
|
HDWallet.prototype.toString = HDWallet.prototype.toBase58 |
|
|
|
|
|
|
|
|
function HmacFromBytesToBytes(hasher, message, key) { |
|
|
|
|
|
var hmac = CJS.algo.HMAC.create(hasher, convert.bytesToWordArray(key)) |
|
|
|
|
|
hmac.update(convert.bytesToWordArray(message)) |
|
|
|
|
|
return convert.wordArrayToBytes(hmac.finalize()) |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
module.exports = HDWallet |
|
|
module.exports = HDWallet |
|
|