SomberNight
7 years ago
28 changed files with 1086 additions and 538 deletions
@ -0,0 +1,142 @@ |
|||
# -*- coding: utf-8 -*- |
|||
# |
|||
# Electrum - lightweight Bitcoin client |
|||
# Copyright (C) 2018 The Electrum developers |
|||
# |
|||
# Permission is hereby granted, free of charge, to any person |
|||
# obtaining a copy of this software and associated documentation files |
|||
# (the "Software"), to deal in the Software without restriction, |
|||
# including without limitation the rights to use, copy, modify, merge, |
|||
# publish, distribute, sublicense, and/or sell copies of the Software, |
|||
# and to permit persons to whom the Software is furnished to do so, |
|||
# subject to the following conditions: |
|||
# |
|||
# The above copyright notice and this permission notice shall be |
|||
# included in all copies or substantial portions of the Software. |
|||
# |
|||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, |
|||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
|||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND |
|||
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS |
|||
# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN |
|||
# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN |
|||
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
|||
# SOFTWARE. |
|||
|
|||
import base64 |
|||
import os |
|||
import hashlib |
|||
|
|||
import pyaes |
|||
|
|||
from .util import assert_bytes, InvalidPassword, to_bytes, to_string |
|||
|
|||
|
|||
try: |
|||
from Cryptodome.Cipher import AES |
|||
except: |
|||
AES = None |
|||
|
|||
|
|||
class InvalidPadding(Exception): |
|||
pass |
|||
|
|||
|
|||
def append_PKCS7_padding(data): |
|||
assert_bytes(data) |
|||
padlen = 16 - (len(data) % 16) |
|||
return data + bytes([padlen]) * padlen |
|||
|
|||
|
|||
def strip_PKCS7_padding(data): |
|||
assert_bytes(data) |
|||
if len(data) % 16 != 0 or len(data) == 0: |
|||
raise InvalidPadding("invalid length") |
|||
padlen = data[-1] |
|||
if padlen > 16: |
|||
raise InvalidPadding("invalid padding byte (large)") |
|||
for i in data[-padlen:]: |
|||
if i != padlen: |
|||
raise InvalidPadding("invalid padding byte (inconsistent)") |
|||
return data[0:-padlen] |
|||
|
|||
|
|||
def aes_encrypt_with_iv(key, iv, data): |
|||
assert_bytes(key, iv, data) |
|||
data = append_PKCS7_padding(data) |
|||
if AES: |
|||
e = AES.new(key, AES.MODE_CBC, iv).encrypt(data) |
|||
else: |
|||
aes_cbc = pyaes.AESModeOfOperationCBC(key, iv=iv) |
|||
aes = pyaes.Encrypter(aes_cbc, padding=pyaes.PADDING_NONE) |
|||
e = aes.feed(data) + aes.feed() # empty aes.feed() flushes buffer |
|||
return e |
|||
|
|||
|
|||
def aes_decrypt_with_iv(key, iv, data): |
|||
assert_bytes(key, iv, data) |
|||
if AES: |
|||
cipher = AES.new(key, AES.MODE_CBC, iv) |
|||
data = cipher.decrypt(data) |
|||
else: |
|||
aes_cbc = pyaes.AESModeOfOperationCBC(key, iv=iv) |
|||
aes = pyaes.Decrypter(aes_cbc, padding=pyaes.PADDING_NONE) |
|||
data = aes.feed(data) + aes.feed() # empty aes.feed() flushes buffer |
|||
try: |
|||
return strip_PKCS7_padding(data) |
|||
except InvalidPadding: |
|||
raise InvalidPassword() |
|||
|
|||
|
|||
def EncodeAES(secret, s): |
|||
assert_bytes(s) |
|||
iv = bytes(os.urandom(16)) |
|||
ct = aes_encrypt_with_iv(secret, iv, s) |
|||
e = iv + ct |
|||
return base64.b64encode(e) |
|||
|
|||
def DecodeAES(secret, e): |
|||
e = bytes(base64.b64decode(e)) |
|||
iv, e = e[:16], e[16:] |
|||
s = aes_decrypt_with_iv(secret, iv, e) |
|||
return s |
|||
|
|||
def pw_encode(s, password): |
|||
if password: |
|||
secret = Hash(password) |
|||
return EncodeAES(secret, to_bytes(s, "utf8")).decode('utf8') |
|||
else: |
|||
return s |
|||
|
|||
def pw_decode(s, password): |
|||
if password is not None: |
|||
secret = Hash(password) |
|||
try: |
|||
d = to_string(DecodeAES(secret, s), "utf8") |
|||
except Exception: |
|||
raise InvalidPassword() |
|||
return d |
|||
else: |
|||
return s |
|||
|
|||
|
|||
def sha256(x: bytes) -> bytes: |
|||
x = to_bytes(x, 'utf8') |
|||
return bytes(hashlib.sha256(x).digest()) |
|||
|
|||
|
|||
def Hash(x: bytes) -> bytes: |
|||
x = to_bytes(x, 'utf8') |
|||
out = bytes(sha256(sha256(x))) |
|||
return out |
|||
|
|||
|
|||
def hash_160(x: bytes) -> bytes: |
|||
try: |
|||
md = hashlib.new('ripemd160') |
|||
md.update(sha256(x)) |
|||
return md.digest() |
|||
except BaseException: |
|||
from . import ripemd |
|||
md = ripemd.new(sha256(x)) |
|||
return md.digest() |
|||
@ -0,0 +1,413 @@ |
|||
# -*- coding: utf-8 -*- |
|||
# |
|||
# Electrum - lightweight Bitcoin client |
|||
# Copyright (C) 2018 The Electrum developers |
|||
# |
|||
# Permission is hereby granted, free of charge, to any person |
|||
# obtaining a copy of this software and associated documentation files |
|||
# (the "Software"), to deal in the Software without restriction, |
|||
# including without limitation the rights to use, copy, modify, merge, |
|||
# publish, distribute, sublicense, and/or sell copies of the Software, |
|||
# and to permit persons to whom the Software is furnished to do so, |
|||
# subject to the following conditions: |
|||
# |
|||
# The above copyright notice and this permission notice shall be |
|||
# included in all copies or substantial portions of the Software. |
|||
# |
|||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, |
|||
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
|||
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND |
|||
# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS |
|||
# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN |
|||
# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN |
|||
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
|||
# SOFTWARE. |
|||
|
|||
import base64 |
|||
import hmac |
|||
import hashlib |
|||
from typing import Union |
|||
|
|||
|
|||
import ecdsa |
|||
from ecdsa.ecdsa import curve_secp256k1, generator_secp256k1 |
|||
from ecdsa.curves import SECP256k1 |
|||
from ecdsa.ellipticcurve import Point |
|||
from ecdsa.util import string_to_number, number_to_string |
|||
|
|||
from .util import bfh, bh2u, assert_bytes, print_error, to_bytes, InvalidPassword, profiler |
|||
from .crypto import (Hash, aes_encrypt_with_iv, aes_decrypt_with_iv) |
|||
from .ecc_fast import do_monkey_patching_of_python_ecdsa_internals_with_libsecp256k1 |
|||
|
|||
|
|||
do_monkey_patching_of_python_ecdsa_internals_with_libsecp256k1() |
|||
|
|||
CURVE_ORDER = SECP256k1.order |
|||
|
|||
|
|||
def generator(): |
|||
return ECPubkey(bfh('0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798')) |
|||
|
|||
|
|||
def sig_string_from_der_sig(der_sig): |
|||
r, s = ecdsa.util.sigdecode_der(der_sig, CURVE_ORDER) |
|||
return ecdsa.util.sigencode_string(r, s, CURVE_ORDER) |
|||
|
|||
|
|||
def der_sig_from_sig_string(sig_string): |
|||
r, s = ecdsa.util.sigdecode_string(sig_string, CURVE_ORDER) |
|||
return ecdsa.util.sigencode_der_canonize(r, s, CURVE_ORDER) |
|||
|
|||
|
|||
def der_sig_from_r_and_s(r, s): |
|||
return ecdsa.util.sigencode_der_canonize(r, s, CURVE_ORDER) |
|||
|
|||
|
|||
def get_r_and_s_from_sig_string(sig_string): |
|||
r, s = ecdsa.util.sigdecode_string(sig_string, CURVE_ORDER) |
|||
return r, s |
|||
|
|||
|
|||
def sig_string_from_r_and_s(r, s): |
|||
return ecdsa.util.sigencode_string_canonize(r, s, CURVE_ORDER) |
|||
|
|||
|
|||
def point_to_ser(P, compressed=True) -> bytes: |
|||
if isinstance(P, tuple): |
|||
assert len(P) == 2, 'unexpected point: %s' % P |
|||
x, y = P |
|||
else: |
|||
x, y = P.x(), P.y() |
|||
if compressed: |
|||
return bfh(('%02x' % (2+(y&1))) + ('%064x' % x)) |
|||
return bfh('04'+('%064x' % x)+('%064x' % y)) |
|||
|
|||
|
|||
def get_y_coord_from_x(x, odd=True): |
|||
curve = curve_secp256k1 |
|||
_p = curve.p() |
|||
_a = curve.a() |
|||
_b = curve.b() |
|||
for offset in range(128): |
|||
Mx = x + offset |
|||
My2 = pow(Mx, 3, _p) + _a * pow(Mx, 2, _p) + _b % _p |
|||
My = pow(My2, (_p + 1) // 4, _p) |
|||
if curve.contains_point(Mx, My): |
|||
if odd == bool(My & 1): |
|||
return My |
|||
return _p - My |
|||
raise Exception('ECC_YfromX: No Y found') |
|||
|
|||
|
|||
def ser_to_point(ser: bytes) -> (int, int): |
|||
if ser[0] not in (0x02, 0x03, 0x04): |
|||
raise ValueError('Unexpected first byte: {}'.format(ser[0])) |
|||
if ser[0] == 0x04: |
|||
return string_to_number(ser[1:33]), string_to_number(ser[33:]) |
|||
x = string_to_number(ser[1:]) |
|||
return x, get_y_coord_from_x(x, ser[0] == 0x03) |
|||
|
|||
|
|||
def _ser_to_python_ecdsa_point(ser: bytes) -> ecdsa.ellipticcurve.Point: |
|||
if ser[0] not in (0x02, 0x03, 0x04): |
|||
raise ValueError('Unexpected first byte: {}'.format(ser[0])) |
|||
x = string_to_number(ser[1:33]) |
|||
if ser[0] == 0x04: |
|||
y = string_to_number(ser[33:]) |
|||
else: |
|||
y = get_y_coord_from_x(x, ser[0] == 0x03) |
|||
return Point(curve_secp256k1, x, y, CURVE_ORDER) |
|||
|
|||
|
|||
class InvalidECPointException(Exception): |
|||
"""e.g. not on curve, or infinity""" |
|||
|
|||
|
|||
class _MyVerifyingKey(ecdsa.VerifyingKey): |
|||
@classmethod |
|||
def from_signature(klass, sig, recid, h, curve): # TODO use libsecp?? |
|||
""" See http://www.secg.org/download/aid-780/sec1-v2.pdf, chapter 4.1.6 """ |
|||
from ecdsa import util, numbertheory |
|||
from . import msqr |
|||
curveFp = curve.curve |
|||
G = curve.generator |
|||
order = G.order() |
|||
# extract r,s from signature |
|||
r, s = util.sigdecode_string(sig, order) |
|||
# 1.1 |
|||
x = r + (recid//2) * order |
|||
# 1.3 |
|||
alpha = ( x * x * x + curveFp.a() * x + curveFp.b() ) % curveFp.p() |
|||
beta = msqr.modular_sqrt(alpha, curveFp.p()) |
|||
y = beta if (beta - recid) % 2 == 0 else curveFp.p() - beta |
|||
# 1.4 the constructor checks that nR is at infinity |
|||
try: |
|||
R = Point(curveFp, x, y, order) |
|||
except: |
|||
raise InvalidECPointException() |
|||
# 1.5 compute e from message: |
|||
e = string_to_number(h) |
|||
minus_e = -e % order |
|||
# 1.6 compute Q = r^-1 (sR - eG) |
|||
inv_r = numbertheory.inverse_mod(r,order) |
|||
Q = inv_r * ( s * R + minus_e * G ) |
|||
return klass.from_public_point( Q, curve ) |
|||
|
|||
|
|||
class _MySigningKey(ecdsa.SigningKey): |
|||
"""Enforce low S values in signatures""" |
|||
|
|||
def sign_number(self, number, entropy=None, k=None): |
|||
r, s = ecdsa.SigningKey.sign_number(self, number, entropy, k) |
|||
if s > CURVE_ORDER//2: |
|||
s = CURVE_ORDER - s |
|||
return r, s |
|||
|
|||
|
|||
class ECPubkey(object): |
|||
|
|||
def __init__(self, b: bytes): |
|||
assert_bytes(b) |
|||
point = _ser_to_python_ecdsa_point(b) |
|||
self._pubkey = ecdsa.ecdsa.Public_key(generator_secp256k1, point) |
|||
|
|||
@classmethod |
|||
def from_sig_string(cls, sig_string: bytes, recid: int, msg_hash: bytes): |
|||
assert_bytes(sig_string) |
|||
if len(sig_string) != 64: |
|||
raise Exception('Wrong encoding') |
|||
if recid < 0 or recid > 3: |
|||
raise ValueError('recid is {}, but should be 0 <= recid <= 3'.format(recid)) |
|||
ecdsa_verifying_key = _MyVerifyingKey.from_signature(sig_string, recid, msg_hash, curve=SECP256k1) |
|||
ecdsa_point = ecdsa_verifying_key.pubkey.point |
|||
return ECPubkey(point_to_ser(ecdsa_point)) |
|||
|
|||
@classmethod |
|||
def from_signature65(cls, sig: bytes, msg_hash: bytes): |
|||
if len(sig) != 65: |
|||
raise Exception("Wrong encoding") |
|||
nV = sig[0] |
|||
if nV < 27 or nV >= 35: |
|||
raise Exception("Bad encoding") |
|||
if nV >= 31: |
|||
compressed = True |
|||
nV -= 4 |
|||
else: |
|||
compressed = False |
|||
recid = nV - 27 |
|||
return cls.from_sig_string(sig[1:], recid, msg_hash), compressed |
|||
|
|||
@classmethod |
|||
def from_point(cls, point): |
|||
_bytes = point_to_ser(point, compressed=False) # faster than compressed |
|||
return ECPubkey(_bytes) |
|||
|
|||
def get_public_key_bytes(self, compressed=True): |
|||
return point_to_ser(self.point(), compressed) |
|||
|
|||
def get_public_key_hex(self, compressed=True): |
|||
return bh2u(self.get_public_key_bytes(compressed)) |
|||
|
|||
def point(self) -> (int, int): |
|||
return self._pubkey.point.x(), self._pubkey.point.y() |
|||
|
|||
def __mul__(self, other: int): |
|||
if not isinstance(other, int): |
|||
raise TypeError('multiplication not defined for ECPubkey and {}'.format(type(other))) |
|||
ecdsa_point = self._pubkey.point * other |
|||
return self.from_point(ecdsa_point) |
|||
|
|||
def __rmul__(self, other: int): |
|||
return self * other |
|||
|
|||
def __add__(self, other): |
|||
if not isinstance(other, ECPubkey): |
|||
raise TypeError('addition not defined for ECPubkey and {}'.format(type(other))) |
|||
ecdsa_point = self._pubkey.point + other._pubkey.point |
|||
return self.from_point(ecdsa_point) |
|||
|
|||
def __eq__(self, other): |
|||
return self.get_public_key_bytes() == other.get_public_key_bytes() |
|||
|
|||
def __ne__(self, other): |
|||
return not (self == other) |
|||
|
|||
def verify_message_for_address(self, sig65: bytes, message: bytes) -> None: |
|||
assert_bytes(message) |
|||
h = Hash(msg_magic(message)) |
|||
public_key, compressed = self.from_signature65(sig65, h) |
|||
# check public key |
|||
if public_key != self: |
|||
raise Exception("Bad signature") |
|||
# check message |
|||
self.verify_message_hash(sig65[1:], h) |
|||
|
|||
def verify_message_hash(self, sig_string: bytes, msg_hash: bytes) -> None: |
|||
assert_bytes(sig_string) |
|||
if len(sig_string) != 64: |
|||
raise Exception('Wrong encoding') |
|||
ecdsa_point = self._pubkey.point |
|||
verifying_key = _MyVerifyingKey.from_public_point(ecdsa_point, curve=SECP256k1) |
|||
verifying_key.verify_digest(sig_string, msg_hash, sigdecode=ecdsa.util.sigdecode_string) |
|||
|
|||
def encrypt_message(self, message: bytes, magic: bytes = b'BIE1'): |
|||
""" |
|||
ECIES encryption/decryption methods; AES-128-CBC with PKCS7 is used as the cipher; hmac-sha256 is used as the mac |
|||
""" |
|||
assert_bytes(message) |
|||
|
|||
randint = ecdsa.util.randrange(CURVE_ORDER) |
|||
ephemeral_exponent = number_to_string(randint, CURVE_ORDER) |
|||
ephemeral = ECPrivkey(ephemeral_exponent) |
|||
ecdh_key = (self * ephemeral.secret_scalar).get_public_key_bytes(compressed=True) |
|||
key = hashlib.sha512(ecdh_key).digest() |
|||
iv, key_e, key_m = key[0:16], key[16:32], key[32:] |
|||
ciphertext = aes_encrypt_with_iv(key_e, iv, message) |
|||
ephemeral_pubkey = ephemeral.get_public_key_bytes(compressed=True) |
|||
encrypted = magic + ephemeral_pubkey + ciphertext |
|||
mac = hmac.new(key_m, encrypted, hashlib.sha256).digest() |
|||
|
|||
return base64.b64encode(encrypted + mac) |
|||
|
|||
@classmethod |
|||
def order(cls): |
|||
return CURVE_ORDER |
|||
|
|||
|
|||
def msg_magic(message: bytes) -> bytes: |
|||
from .bitcoin import var_int |
|||
length = bfh(var_int(len(message))) |
|||
return b"\x18Bitcoin Signed Message:\n" + length + message |
|||
|
|||
|
|||
def verify_message_with_address(address: str, sig65: bytes, message: bytes): |
|||
from .bitcoin import pubkey_to_address |
|||
assert_bytes(sig65, message) |
|||
try: |
|||
h = Hash(msg_magic(message)) |
|||
public_key, compressed = ECPubkey.from_signature65(sig65, h) |
|||
# check public key using the address |
|||
pubkey_hex = public_key.get_public_key_hex(compressed) |
|||
for txin_type in ['p2pkh','p2wpkh','p2wpkh-p2sh']: |
|||
addr = pubkey_to_address(txin_type, pubkey_hex) |
|||
if address == addr: |
|||
break |
|||
else: |
|||
raise Exception("Bad signature") |
|||
# check message |
|||
public_key.verify_message_hash(sig65[1:], h) |
|||
return True |
|||
except Exception as e: |
|||
print_error("Verification error: {0}".format(e)) |
|||
return False |
|||
|
|||
|
|||
def is_secret_within_curve_range(secret: Union[int, bytes]) -> bool: |
|||
if isinstance(secret, bytes): |
|||
secret = string_to_number(secret) |
|||
return 0 < secret < CURVE_ORDER |
|||
|
|||
|
|||
class ECPrivkey(ECPubkey): |
|||
|
|||
def __init__(self, privkey_bytes: bytes): |
|||
assert_bytes(privkey_bytes) |
|||
if len(privkey_bytes) != 32: |
|||
raise Exception('unexpected size for secret. should be 32 bytes, not {}'.format(len(privkey_bytes))) |
|||
secret = string_to_number(privkey_bytes) |
|||
if not is_secret_within_curve_range(secret): |
|||
raise Exception('Invalid secret scalar (not within curve order)') |
|||
self.secret_scalar = secret |
|||
|
|||
point = generator_secp256k1 * secret |
|||
super().__init__(point_to_ser(point)) |
|||
self._privkey = ecdsa.ecdsa.Private_key(self._pubkey, secret) |
|||
|
|||
@classmethod |
|||
def from_secret_scalar(cls, secret_scalar: int): |
|||
secret_bytes = number_to_string(secret_scalar, CURVE_ORDER) |
|||
return ECPrivkey(secret_bytes) |
|||
|
|||
@classmethod |
|||
def from_arbitrary_size_secret(cls, privkey_bytes: bytes): |
|||
"""This method is only for legacy reasons. Do not introduce new code that uses it. |
|||
Unlike the default constructor, this method does not require len(privkey_bytes) == 32, |
|||
and the secret does not need to be within the curve order either. |
|||
""" |
|||
return ECPrivkey(cls.normalize_secret_bytes(privkey_bytes)) |
|||
|
|||
@classmethod |
|||
def normalize_secret_bytes(cls, privkey_bytes: bytes) -> bytes: |
|||
scalar = string_to_number(privkey_bytes) % CURVE_ORDER |
|||
if scalar == 0: |
|||
raise Exception('invalid EC private key scalar: zero') |
|||
privkey_32bytes = number_to_string(scalar, CURVE_ORDER) |
|||
return privkey_32bytes |
|||
|
|||
def sign_transaction(self, hashed_preimage): |
|||
private_key = _MySigningKey.from_secret_exponent(self.secret_scalar, curve=SECP256k1) |
|||
sig = private_key.sign_digest_deterministic(hashed_preimage, hashfunc=hashlib.sha256, |
|||
sigencode=ecdsa.util.sigencode_der) |
|||
public_key = private_key.get_verifying_key() |
|||
if not public_key.verify_digest(sig, hashed_preimage, sigdecode=ecdsa.util.sigdecode_der): |
|||
raise Exception('Sanity check verifying our own signature failed.') |
|||
return sig |
|||
|
|||
def sign_message(self, message, is_compressed): |
|||
def sign_with_python_ecdsa(msg_hash): |
|||
private_key = _MySigningKey.from_secret_exponent(self.secret_scalar, curve=SECP256k1) |
|||
public_key = private_key.get_verifying_key() |
|||
signature = private_key.sign_digest_deterministic(msg_hash, hashfunc=hashlib.sha256, sigencode=ecdsa.util.sigencode_string) |
|||
if not public_key.verify_digest(signature, msg_hash, sigdecode=ecdsa.util.sigdecode_string): |
|||
raise Exception('Sanity check verifying our own signature failed.') |
|||
return signature |
|||
|
|||
def bruteforce_recid(sig_string): |
|||
for recid in range(4): |
|||
sig65 = construct_sig65(sig_string, recid, is_compressed) |
|||
try: |
|||
self.verify_message_for_address(sig65, message) |
|||
return sig65, recid |
|||
except Exception as e: |
|||
continue |
|||
else: |
|||
raise Exception("error: cannot sign message. no recid fits..") |
|||
|
|||
message = to_bytes(message, 'utf8') |
|||
msg_hash = Hash(msg_magic(message)) |
|||
sig_string = sign_with_python_ecdsa(msg_hash) |
|||
sig65, recid = bruteforce_recid(sig_string) |
|||
try: |
|||
self.verify_message_for_address(sig65, message) |
|||
return sig65 |
|||
except Exception as e: |
|||
raise Exception("error: cannot sign message. self-verify sanity check failed") |
|||
|
|||
def decrypt_message(self, encrypted, magic=b'BIE1'): |
|||
encrypted = base64.b64decode(encrypted) |
|||
if len(encrypted) < 85: |
|||
raise Exception('invalid ciphertext: length') |
|||
magic_found = encrypted[:4] |
|||
ephemeral_pubkey_bytes = encrypted[4:37] |
|||
ciphertext = encrypted[37:-32] |
|||
mac = encrypted[-32:] |
|||
if magic_found != magic: |
|||
raise Exception('invalid ciphertext: invalid magic bytes') |
|||
try: |
|||
ecdsa_point = _ser_to_python_ecdsa_point(ephemeral_pubkey_bytes) |
|||
except AssertionError as e: |
|||
raise Exception('invalid ciphertext: invalid ephemeral pubkey') from e |
|||
if not ecdsa.ecdsa.point_is_valid(generator_secp256k1, ecdsa_point.x(), ecdsa_point.y()): |
|||
raise Exception('invalid ciphertext: invalid ephemeral pubkey') |
|||
ephemeral_pubkey = ECPubkey(point_to_ser(ecdsa_point)) |
|||
ecdh_key = (ephemeral_pubkey * self.secret_scalar).get_public_key_bytes(compressed=True) |
|||
key = hashlib.sha512(ecdh_key).digest() |
|||
iv, key_e, key_m = key[0:16], key[16:32], key[32:] |
|||
if mac != hmac.new(key_m, encrypted[:-32], hashlib.sha256).digest(): |
|||
raise InvalidPassword() |
|||
return aes_decrypt_with_iv(key_e, iv, ciphertext) |
|||
|
|||
|
|||
def construct_sig65(sig_string, recid, is_compressed): |
|||
comp = 4 if is_compressed else 0 |
|||
return bytes([27 + recid + comp]) + sig_string |
|||
@ -0,0 +1,221 @@ |
|||
# taken (with minor modifications) from pycoin |
|||
# https://github.com/richardkiss/pycoin/blob/01b1787ed902df23f99a55deb00d8cd076a906fe/pycoin/ecdsa/native/secp256k1.py |
|||
|
|||
import os |
|||
import sys |
|||
import traceback |
|||
import ctypes |
|||
from ctypes.util import find_library |
|||
from ctypes import ( |
|||
byref, c_byte, c_int, c_uint, c_char_p, c_size_t, c_void_p, create_string_buffer, CFUNCTYPE, POINTER |
|||
) |
|||
|
|||
import ecdsa |
|||
|
|||
from .util import print_stderr, print_error |
|||
|
|||
|
|||
SECP256K1_FLAGS_TYPE_MASK = ((1 << 8) - 1) |
|||
SECP256K1_FLAGS_TYPE_CONTEXT = (1 << 0) |
|||
SECP256K1_FLAGS_TYPE_COMPRESSION = (1 << 1) |
|||
# /** The higher bits contain the actual data. Do not use directly. */ |
|||
SECP256K1_FLAGS_BIT_CONTEXT_VERIFY = (1 << 8) |
|||
SECP256K1_FLAGS_BIT_CONTEXT_SIGN = (1 << 9) |
|||
SECP256K1_FLAGS_BIT_COMPRESSION = (1 << 8) |
|||
|
|||
# /** Flags to pass to secp256k1_context_create. */ |
|||
SECP256K1_CONTEXT_VERIFY = (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_VERIFY) |
|||
SECP256K1_CONTEXT_SIGN = (SECP256K1_FLAGS_TYPE_CONTEXT | SECP256K1_FLAGS_BIT_CONTEXT_SIGN) |
|||
SECP256K1_CONTEXT_NONE = (SECP256K1_FLAGS_TYPE_CONTEXT) |
|||
|
|||
SECP256K1_EC_COMPRESSED = (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION) |
|||
SECP256K1_EC_UNCOMPRESSED = (SECP256K1_FLAGS_TYPE_COMPRESSION) |
|||
|
|||
|
|||
# TODO double check ctypes arg/return value types against https://github.com/bitcoin-core/secp256k1/blob/master/src/secp256k1.c |
|||
def load_library(): |
|||
library_path = ctypes.util.find_library('libsecp256k1') or \ |
|||
ctypes.util.find_library('secp256k1') |
|||
if not library_path: |
|||
print_error('[ecc] info: libsecp256k1 library was not found, trying fallback name') |
|||
if sys.platform == 'darwin': |
|||
library_path = 'libsecp256k1.dylib' |
|||
elif sys.platform in ('windows', 'win32'): |
|||
library_path = 'libsecp256k1.dll' |
|||
else: |
|||
library_path = 'libsecp256k1.so.0' |
|||
|
|||
secp256k1 = ctypes.cdll.LoadLibrary(library_path) |
|||
if not secp256k1: |
|||
print_stderr('[ecc] warning: libsecp256k1 library failed to load') |
|||
return None |
|||
|
|||
try: |
|||
secp256k1.secp256k1_context_create.argtypes = [c_uint] |
|||
secp256k1.secp256k1_context_create.restype = c_void_p |
|||
|
|||
secp256k1.secp256k1_context_randomize.argtypes = [c_void_p, c_char_p] |
|||
secp256k1.secp256k1_context_randomize.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ec_pubkey_create.argtypes = [c_void_p, c_void_p, c_char_p] |
|||
secp256k1.secp256k1_ec_pubkey_create.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ecdsa_sign.argtypes = [c_void_p, c_char_p, c_char_p, c_char_p, c_void_p, c_void_p] |
|||
secp256k1.secp256k1_ecdsa_sign.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ecdsa_verify.argtypes = [c_void_p, c_char_p, c_char_p, c_char_p] |
|||
secp256k1.secp256k1_ecdsa_verify.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ec_pubkey_parse.argtypes = [c_void_p, c_char_p, c_char_p, c_size_t] |
|||
secp256k1.secp256k1_ec_pubkey_parse.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ec_pubkey_serialize.argtypes = [c_void_p, c_char_p, c_void_p, c_char_p, c_uint] |
|||
secp256k1.secp256k1_ec_pubkey_serialize.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ecdsa_signature_parse_compact.argtypes = [c_void_p, c_char_p, c_char_p] |
|||
secp256k1.secp256k1_ecdsa_signature_parse_compact.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ecdsa_signature_serialize_compact.argtypes = [c_void_p, c_char_p, c_char_p] |
|||
secp256k1.secp256k1_ecdsa_signature_serialize_compact.restype = c_int |
|||
|
|||
secp256k1.secp256k1_ec_pubkey_tweak_mul.argtypes = [c_void_p, c_char_p, c_char_p] |
|||
secp256k1.secp256k1_ec_pubkey_tweak_mul.restype = c_int |
|||
|
|||
secp256k1.ctx = secp256k1.secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY) |
|||
r = secp256k1.secp256k1_context_randomize(secp256k1.ctx, os.urandom(32)) |
|||
if r: |
|||
return secp256k1 |
|||
else: |
|||
print_stderr('[ecc] warning: secp256k1_context_randomize failed') |
|||
return None |
|||
except (OSError, AttributeError): |
|||
#traceback.print_exc(file=sys.stderr) |
|||
print_stderr('[ecc] warning: libsecp256k1 library was found and loaded but there was an error when using it') |
|||
return None |
|||
|
|||
|
|||
class _patched_functions: |
|||
prepared_to_patch = False |
|||
monkey_patching_active = False |
|||
|
|||
|
|||
def _prepare_monkey_patching_of_python_ecdsa_internals_with_libsecp256k1(): |
|||
if not _libsecp256k1: |
|||
return |
|||
|
|||
# save original functions so that we can undo patching (needed for tests) |
|||
_patched_functions.orig_sign = staticmethod(ecdsa.ecdsa.Private_key.sign) |
|||
_patched_functions.orig_verify = staticmethod(ecdsa.ecdsa.Public_key.verifies) |
|||
_patched_functions.orig_mul = staticmethod(ecdsa.ellipticcurve.Point.__mul__) |
|||
|
|||
curve_secp256k1 = ecdsa.ecdsa.curve_secp256k1 |
|||
curve_order = ecdsa.curves.SECP256k1.order |
|||
point_at_infinity = ecdsa.ellipticcurve.INFINITY |
|||
|
|||
def mul(self: ecdsa.ellipticcurve.Point, other: int): |
|||
if self.curve() != curve_secp256k1: |
|||
# this operation is not on the secp256k1 curve; use original implementation |
|||
return _patched_functions.orig_mul(self, other) |
|||
other %= curve_order |
|||
if self == point_at_infinity or other == 0: |
|||
return point_at_infinity |
|||
pubkey = create_string_buffer(64) |
|||
public_pair_bytes = b'\4' + self.x().to_bytes(32, byteorder="big") + self.y().to_bytes(32, byteorder="big") |
|||
r = _libsecp256k1.secp256k1_ec_pubkey_parse( |
|||
_libsecp256k1.ctx, pubkey, public_pair_bytes, len(public_pair_bytes)) |
|||
if not r: |
|||
return False |
|||
r = _libsecp256k1.secp256k1_ec_pubkey_tweak_mul(_libsecp256k1.ctx, pubkey, other.to_bytes(32, byteorder="big")) |
|||
if not r: |
|||
return point_at_infinity |
|||
|
|||
pubkey_serialized = create_string_buffer(65) |
|||
pubkey_size = c_size_t(65) |
|||
_libsecp256k1.secp256k1_ec_pubkey_serialize( |
|||
_libsecp256k1.ctx, pubkey_serialized, byref(pubkey_size), pubkey, SECP256K1_EC_UNCOMPRESSED) |
|||
x = int.from_bytes(pubkey_serialized[1:33], byteorder="big") |
|||
y = int.from_bytes(pubkey_serialized[33:], byteorder="big") |
|||
return ecdsa.ellipticcurve.Point(curve_secp256k1, x, y, curve_order) |
|||
|
|||
def sign(self: ecdsa.ecdsa.Private_key, hash: int, random_k: int): |
|||
# note: random_k is ignored |
|||
if self.public_key.curve != curve_secp256k1: |
|||
# this operation is not on the secp256k1 curve; use original implementation |
|||
return _patched_functions.orig_sign(self, hash, random_k) |
|||
secret_exponent = self.secret_multiplier |
|||
nonce_function = None |
|||
sig = create_string_buffer(64) |
|||
sig_hash_bytes = hash.to_bytes(32, byteorder="big") |
|||
_libsecp256k1.secp256k1_ecdsa_sign( |
|||
_libsecp256k1.ctx, sig, sig_hash_bytes, secret_exponent.to_bytes(32, byteorder="big"), nonce_function, None) |
|||
compact_signature = create_string_buffer(64) |
|||
_libsecp256k1.secp256k1_ecdsa_signature_serialize_compact(_libsecp256k1.ctx, compact_signature, sig) |
|||
r = int.from_bytes(compact_signature[:32], byteorder="big") |
|||
s = int.from_bytes(compact_signature[32:], byteorder="big") |
|||
return ecdsa.ecdsa.Signature(r, s) |
|||
|
|||
def verify(self: ecdsa.ecdsa.Public_key, hash: int, signature: ecdsa.ecdsa.Signature): |
|||
if self.curve != curve_secp256k1: |
|||
# this operation is not on the secp256k1 curve; use original implementation |
|||
return _patched_functions.orig_verify(self, hash, signature) |
|||
sig = create_string_buffer(64) |
|||
input64 = signature.r.to_bytes(32, byteorder="big") + signature.s.to_bytes(32, byteorder="big") |
|||
r = _libsecp256k1.secp256k1_ecdsa_signature_parse_compact(_libsecp256k1.ctx, sig, input64) |
|||
if not r: |
|||
return False |
|||
r = _libsecp256k1.secp256k1_ecdsa_signature_normalize(_libsecp256k1.ctx, sig, sig) |
|||
|
|||
public_pair_bytes = b'\4' + self.point.x().to_bytes(32, byteorder="big") + self.point.y().to_bytes(32, byteorder="big") |
|||
pubkey = create_string_buffer(64) |
|||
r = _libsecp256k1.secp256k1_ec_pubkey_parse( |
|||
_libsecp256k1.ctx, pubkey, public_pair_bytes, len(public_pair_bytes)) |
|||
if not r: |
|||
return False |
|||
|
|||
return 1 == _libsecp256k1.secp256k1_ecdsa_verify(_libsecp256k1.ctx, sig, hash.to_bytes(32, byteorder="big"), pubkey) |
|||
|
|||
# save new functions so that we can (re-)do patching |
|||
_patched_functions.fast_sign = sign |
|||
_patched_functions.fast_verify = verify |
|||
_patched_functions.fast_mul = mul |
|||
|
|||
_patched_functions.prepared_to_patch = True |
|||
|
|||
|
|||
def do_monkey_patching_of_python_ecdsa_internals_with_libsecp256k1(): |
|||
if not _libsecp256k1: |
|||
print_stderr('[ecc] warning: libsecp256k1 library not available, falling back to python-ecdsa') |
|||
return |
|||
if not _patched_functions.prepared_to_patch: |
|||
raise Exception("can't patch python-ecdsa without preparations") |
|||
ecdsa.ecdsa.Private_key.sign = _patched_functions.fast_sign |
|||
ecdsa.ecdsa.Public_key.verifies = _patched_functions.fast_verify |
|||
ecdsa.ellipticcurve.Point.__mul__ = _patched_functions.fast_mul |
|||
# ecdsa.ellipticcurve.Point.__add__ = ... # TODO?? |
|||
|
|||
_patched_functions.monkey_patching_active = True |
|||
|
|||
|
|||
def undo_monkey_patching_of_python_ecdsa_internals_with_libsecp256k1(): |
|||
if not _libsecp256k1: |
|||
return |
|||
if not _patched_functions.prepared_to_patch: |
|||
raise Exception("can't patch python-ecdsa without preparations") |
|||
ecdsa.ecdsa.Private_key.sign = _patched_functions.orig_sign |
|||
ecdsa.ecdsa.Public_key.verifies = _patched_functions.orig_verify |
|||
ecdsa.ellipticcurve.Point.__mul__ = _patched_functions.orig_mul |
|||
|
|||
_patched_functions.monkey_patching_active = False |
|||
|
|||
|
|||
def is_using_fast_ecc(): |
|||
return _patched_functions.monkey_patching_active |
|||
|
|||
|
|||
try: |
|||
_libsecp256k1 = load_library() |
|||
except: |
|||
_libsecp256k1 = None |
|||
traceback.print_exc(file=sys.stderr) |
|||
|
|||
_prepare_monkey_patching_of_python_ecdsa_internals_with_libsecp256k1() |
|||
Loading…
Reference in new issue