SomberNight
7 years ago
24 changed files with 393 additions and 374 deletions
@ -0,0 +1,269 @@ |
|||
# Copyright (C) 2018 The Electrum developers |
|||
# Distributed under the MIT software license, see the accompanying |
|||
# file LICENCE or http://www.opensource.org/licenses/mit-license.php |
|||
|
|||
import hashlib |
|||
from typing import List |
|||
|
|||
from .util import bfh, bh2u, BitcoinException, print_error |
|||
from . import constants |
|||
from . import ecc |
|||
from .crypto import hash_160, hmac_oneshot |
|||
from .bitcoin import rev_hex, int_to_hex, EncodeBase58Check, DecodeBase58Check |
|||
|
|||
|
|||
BIP32_PRIME = 0x80000000 |
|||
|
|||
|
|||
def protect_against_invalid_ecpoint(func): |
|||
def func_wrapper(*args): |
|||
n = args[-1] |
|||
while True: |
|||
is_prime = n & BIP32_PRIME |
|||
try: |
|||
return func(*args[:-1], n=n) |
|||
except ecc.InvalidECPointException: |
|||
print_error('bip32 protect_against_invalid_ecpoint: skipping index') |
|||
n += 1 |
|||
is_prime2 = n & BIP32_PRIME |
|||
if is_prime != is_prime2: raise OverflowError() |
|||
return func_wrapper |
|||
|
|||
|
|||
# Child private key derivation function (from master private key) |
|||
# k = master private key (32 bytes) |
|||
# c = master chain code (extra entropy for key derivation) (32 bytes) |
|||
# n = the index of the key we want to derive. (only 32 bits will be used) |
|||
# If n is hardened (i.e. the 32nd bit is set), the resulting private key's |
|||
# corresponding public key can NOT be determined without the master private key. |
|||
# However, if n is not hardened, the resulting private key's corresponding |
|||
# public key can be determined without the master private key. |
|||
@protect_against_invalid_ecpoint |
|||
def CKD_priv(k, c, n): |
|||
if n < 0: raise ValueError('the bip32 index needs to be non-negative') |
|||
is_prime = n & BIP32_PRIME |
|||
return _CKD_priv(k, c, bfh(rev_hex(int_to_hex(n,4))), is_prime) |
|||
|
|||
|
|||
def _CKD_priv(k, c, s, is_prime): |
|||
try: |
|||
keypair = ecc.ECPrivkey(k) |
|||
except ecc.InvalidECPointException as e: |
|||
raise BitcoinException('Impossible xprv (not within curve order)') from e |
|||
cK = keypair.get_public_key_bytes(compressed=True) |
|||
data = bytes([0]) + k + s if is_prime else cK + s |
|||
I = hmac_oneshot(c, data, hashlib.sha512) |
|||
I_left = ecc.string_to_number(I[0:32]) |
|||
k_n = (I_left + ecc.string_to_number(k)) % ecc.CURVE_ORDER |
|||
if I_left >= ecc.CURVE_ORDER or k_n == 0: |
|||
raise ecc.InvalidECPointException() |
|||
k_n = ecc.number_to_string(k_n, ecc.CURVE_ORDER) |
|||
c_n = I[32:] |
|||
return k_n, c_n |
|||
|
|||
# Child public key derivation function (from public key only) |
|||
# K = master public key |
|||
# c = master chain code |
|||
# n = index of key we want to derive |
|||
# This function allows us to find the nth public key, as long as n is |
|||
# not hardened. If n is hardened, we need the master private key to find it. |
|||
@protect_against_invalid_ecpoint |
|||
def CKD_pub(cK, c, n): |
|||
if n < 0: raise ValueError('the bip32 index needs to be non-negative') |
|||
if n & BIP32_PRIME: raise Exception() |
|||
return _CKD_pub(cK, c, bfh(rev_hex(int_to_hex(n,4)))) |
|||
|
|||
# helper function, callable with arbitrary string. |
|||
# note: 's' does not need to fit into 32 bits here! (c.f. trustedcoin billing) |
|||
def _CKD_pub(cK, c, s): |
|||
I = hmac_oneshot(c, cK + s, hashlib.sha512) |
|||
pubkey = ecc.ECPrivkey(I[0:32]) + ecc.ECPubkey(cK) |
|||
if pubkey.is_at_infinity(): |
|||
raise ecc.InvalidECPointException() |
|||
cK_n = pubkey.get_public_key_bytes(compressed=True) |
|||
c_n = I[32:] |
|||
return cK_n, c_n |
|||
|
|||
|
|||
def xprv_header(xtype, *, net=None): |
|||
if net is None: |
|||
net = constants.net |
|||
return bfh("%08x" % net.XPRV_HEADERS[xtype]) |
|||
|
|||
|
|||
def xpub_header(xtype, *, net=None): |
|||
if net is None: |
|||
net = constants.net |
|||
return bfh("%08x" % net.XPUB_HEADERS[xtype]) |
|||
|
|||
|
|||
def serialize_xprv(xtype, c, k, depth=0, fingerprint=b'\x00'*4, |
|||
child_number=b'\x00'*4, *, net=None): |
|||
if not ecc.is_secret_within_curve_range(k): |
|||
raise BitcoinException('Impossible xprv (not within curve order)') |
|||
xprv = xprv_header(xtype, net=net) \ |
|||
+ bytes([depth]) + fingerprint + child_number + c + bytes([0]) + k |
|||
return EncodeBase58Check(xprv) |
|||
|
|||
|
|||
def serialize_xpub(xtype, c, cK, depth=0, fingerprint=b'\x00'*4, |
|||
child_number=b'\x00'*4, *, net=None): |
|||
xpub = xpub_header(xtype, net=net) \ |
|||
+ bytes([depth]) + fingerprint + child_number + c + cK |
|||
return EncodeBase58Check(xpub) |
|||
|
|||
|
|||
class InvalidMasterKeyVersionBytes(BitcoinException): pass |
|||
|
|||
|
|||
def deserialize_xkey(xkey, prv, *, net=None): |
|||
if net is None: |
|||
net = constants.net |
|||
xkey = DecodeBase58Check(xkey) |
|||
if len(xkey) != 78: |
|||
raise BitcoinException('Invalid length for extended key: {}' |
|||
.format(len(xkey))) |
|||
depth = xkey[4] |
|||
fingerprint = xkey[5:9] |
|||
child_number = xkey[9:13] |
|||
c = xkey[13:13+32] |
|||
header = int('0x' + bh2u(xkey[0:4]), 16) |
|||
headers = net.XPRV_HEADERS if prv else net.XPUB_HEADERS |
|||
if header not in headers.values(): |
|||
raise InvalidMasterKeyVersionBytes('Invalid extended key format: {}' |
|||
.format(hex(header))) |
|||
xtype = list(headers.keys())[list(headers.values()).index(header)] |
|||
n = 33 if prv else 32 |
|||
K_or_k = xkey[13+n:] |
|||
if prv and not ecc.is_secret_within_curve_range(K_or_k): |
|||
raise BitcoinException('Impossible xprv (not within curve order)') |
|||
return xtype, depth, fingerprint, child_number, c, K_or_k |
|||
|
|||
|
|||
def deserialize_xpub(xkey, *, net=None): |
|||
return deserialize_xkey(xkey, False, net=net) |
|||
|
|||
def deserialize_xprv(xkey, *, net=None): |
|||
return deserialize_xkey(xkey, True, net=net) |
|||
|
|||
def xpub_type(x): |
|||
return deserialize_xpub(x)[0] |
|||
|
|||
|
|||
def is_xpub(text): |
|||
try: |
|||
deserialize_xpub(text) |
|||
return True |
|||
except: |
|||
return False |
|||
|
|||
|
|||
def is_xprv(text): |
|||
try: |
|||
deserialize_xprv(text) |
|||
return True |
|||
except: |
|||
return False |
|||
|
|||
|
|||
def xpub_from_xprv(xprv): |
|||
xtype, depth, fingerprint, child_number, c, k = deserialize_xprv(xprv) |
|||
cK = ecc.ECPrivkey(k).get_public_key_bytes(compressed=True) |
|||
return serialize_xpub(xtype, c, cK, depth, fingerprint, child_number) |
|||
|
|||
|
|||
def bip32_root(seed, xtype): |
|||
I = hmac_oneshot(b"Bitcoin seed", seed, hashlib.sha512) |
|||
master_k = I[0:32] |
|||
master_c = I[32:] |
|||
# create xprv first, as that will check if master_k is within curve order |
|||
xprv = serialize_xprv(xtype, master_c, master_k) |
|||
cK = ecc.ECPrivkey(master_k).get_public_key_bytes(compressed=True) |
|||
xpub = serialize_xpub(xtype, master_c, cK) |
|||
return xprv, xpub |
|||
|
|||
|
|||
def xpub_from_pubkey(xtype, cK): |
|||
if cK[0] not in (0x02, 0x03): |
|||
raise ValueError('Unexpected first byte: {}'.format(cK[0])) |
|||
return serialize_xpub(xtype, b'\x00'*32, cK) |
|||
|
|||
|
|||
def bip32_derivation(s): |
|||
if not s.startswith('m/'): |
|||
raise ValueError('invalid bip32 derivation path: {}'.format(s)) |
|||
s = s[2:] |
|||
for n in s.split('/'): |
|||
if n == '': continue |
|||
i = int(n[:-1]) + BIP32_PRIME if n[-1] == "'" else int(n) |
|||
yield i |
|||
|
|||
def convert_bip32_path_to_list_of_uint32(n: str) -> List[int]: |
|||
"""Convert bip32 path to list of uint32 integers with prime flags |
|||
m/0/-1/1' -> [0, 0x80000001, 0x80000001] |
|||
|
|||
based on code in trezorlib |
|||
""" |
|||
path = [] |
|||
for x in n.split('/')[1:]: |
|||
if x == '': continue |
|||
prime = 0 |
|||
if x.endswith("'"): |
|||
x = x.replace('\'', '') |
|||
prime = BIP32_PRIME |
|||
if x.startswith('-'): |
|||
prime = BIP32_PRIME |
|||
path.append(abs(int(x)) | prime) |
|||
return path |
|||
|
|||
def is_bip32_derivation(x): |
|||
try: |
|||
[ i for i in bip32_derivation(x)] |
|||
return True |
|||
except : |
|||
return False |
|||
|
|||
def bip32_private_derivation(xprv, branch, sequence): |
|||
if not sequence.startswith(branch): |
|||
raise ValueError('incompatible branch ({}) and sequence ({})' |
|||
.format(branch, sequence)) |
|||
if branch == sequence: |
|||
return xprv, xpub_from_xprv(xprv) |
|||
xtype, depth, fingerprint, child_number, c, k = deserialize_xprv(xprv) |
|||
sequence = sequence[len(branch):] |
|||
for n in sequence.split('/'): |
|||
if n == '': continue |
|||
i = int(n[:-1]) + BIP32_PRIME if n[-1] == "'" else int(n) |
|||
parent_k = k |
|||
k, c = CKD_priv(k, c, i) |
|||
depth += 1 |
|||
parent_cK = ecc.ECPrivkey(parent_k).get_public_key_bytes(compressed=True) |
|||
fingerprint = hash_160(parent_cK)[0:4] |
|||
child_number = bfh("%08X"%i) |
|||
cK = ecc.ECPrivkey(k).get_public_key_bytes(compressed=True) |
|||
xpub = serialize_xpub(xtype, c, cK, depth, fingerprint, child_number) |
|||
xprv = serialize_xprv(xtype, c, k, depth, fingerprint, child_number) |
|||
return xprv, xpub |
|||
|
|||
|
|||
def bip32_public_derivation(xpub, branch, sequence): |
|||
xtype, depth, fingerprint, child_number, c, cK = deserialize_xpub(xpub) |
|||
if not sequence.startswith(branch): |
|||
raise ValueError('incompatible branch ({}) and sequence ({})' |
|||
.format(branch, sequence)) |
|||
sequence = sequence[len(branch):] |
|||
for n in sequence.split('/'): |
|||
if n == '': continue |
|||
i = int(n) |
|||
parent_cK = cK |
|||
cK, c = CKD_pub(cK, c, i) |
|||
depth += 1 |
|||
fingerprint = hash_160(parent_cK)[0:4] |
|||
child_number = bfh("%08X"%i) |
|||
return serialize_xpub(xtype, c, cK, depth, fingerprint, child_number) |
|||
|
|||
|
|||
def bip32_private_key(sequence, k, chain): |
|||
for i in sequence: |
|||
k, chain = CKD_priv(k, chain, i) |
|||
return k |
|||
Loading…
Reference in new issue