key.cpp

Go to the documentation of this file.

// Copyright (c) 2009-2016 The Bitcoin Core developers
// Copyright (c) 2017 The Zcash developers
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.

#include <key.h>

#include <crypto/common.h>
#include <crypto/hmac_sha512.h>
#include <random.h>

#include <secp256k1.h>
#include <secp256k1_recovery.h>
#include <secp256k1_schnorr.h>

static secp256k1_context *secp256k1_context_sign = nullptr;

static int ec_privkey_import_der(const secp256k1_context *ctx, uint8_t *out32,
                                 const uint8_t *privkey, size_t privkeylen) {
    const uint8_t *end = privkey + privkeylen;
    memset(out32, 0, 32);
    /* sequence header */
    if (end - privkey < 1 || *privkey != 0x30u) {
        return 0;
    }
    privkey++;
    /* sequence length constructor */
    if (end - privkey < 1 || !(*privkey & 0x80u)) {
        return 0;
    }
    ptrdiff_t lenb = *privkey & ~0x80u;
    privkey++;
    if (lenb < 1 || lenb > 2) {
        return 0;
    }
    if (end - privkey < lenb) {
        return 0;
    }
    /* sequence length */
    ptrdiff_t len =
        privkey[lenb - 1] | (lenb > 1 ? privkey[lenb - 2] << 8 : 0u);
    privkey += lenb;
    if (end - privkey < len) {
        return 0;
    }
    /* sequence element 0: version number (=1) */
    if (end - privkey < 3 || privkey[0] != 0x02u || privkey[1] != 0x01u ||
        privkey[2] != 0x01u) {
        return 0;
    }
    privkey += 3;
    /* sequence element 1: octet string, up to 32 bytes */
    if (end - privkey < 2 || privkey[0] != 0x04u) {
        return 0;
    }
    ptrdiff_t oslen = privkey[1];
    privkey += 2;
    if (oslen > 32 || end - privkey < oslen) {
        return 0;
    }
    memcpy(out32 + (32 - oslen), privkey, oslen);
    if (!secp256k1_ec_seckey_verify(ctx, out32)) {
        memset(out32, 0, 32);
        return 0;
    }
    return 1;
}

static int ec_privkey_export_der(const secp256k1_context *ctx, uint8_t *privkey,
                                 size_t *privkeylen, const uint8_t *key32,
                                 bool compressed) {
    assert(*privkeylen >= CKey::SIZE);
    secp256k1_pubkey pubkey;
    size_t pubkeylen = 0;
    if (!secp256k1_ec_pubkey_create(ctx, &pubkey, key32)) {
        *privkeylen = 0;
        return 0;
    }

    if (compressed) {
        static const uint8_t begin[] = {0x30, 0x81, 0xD3, 0x02,
                                        0x01, 0x01, 0x04, 0x20};
        static const uint8_t middle[] = {
            0xA0, 0x81, 0x85, 0x30, 0x81, 0x82, 0x02, 0x01, 0x01, 0x30, 0x2C,
            0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x01, 0x01, 0x02, 0x21,
            0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
            0x30, 0x06, 0x04, 0x01, 0x00, 0x04, 0x01, 0x07, 0x04, 0x21, 0x02,
            0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC, 0x55, 0xA0, 0x62,
            0x95, 0xCE, 0x87, 0x0B, 0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE,
            0x28, 0xD9, 0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17, 0x98, 0x02,
            0x21, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xBA, 0xAE, 0xDC, 0xE6,
            0xAF, 0x48, 0xA0, 0x3B, 0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41,
            0x41, 0x02, 0x01, 0x01, 0xA1, 0x24, 0x03, 0x22, 0x00};
        uint8_t *ptr = privkey;
        memcpy(ptr, begin, sizeof(begin));
        ptr += sizeof(begin);
        memcpy(ptr, key32, 32);
        ptr += 32;
        memcpy(ptr, middle, sizeof(middle));
        ptr += sizeof(middle);
        pubkeylen = CPubKey::COMPRESSED_SIZE;
        secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey,
                                      SECP256K1_EC_COMPRESSED);
        ptr += pubkeylen;
        *privkeylen = ptr - privkey;
        assert(*privkeylen == CKey::COMPRESSED_SIZE);
    } else {
        static const uint8_t begin[] = {0x30, 0x82, 0x01, 0x13, 0x02,
                                        0x01, 0x01, 0x04, 0x20};
        static const uint8_t middle[] = {
            0xA0, 0x81, 0xA5, 0x30, 0x81, 0xA2, 0x02, 0x01, 0x01, 0x30, 0x2C,
            0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x01, 0x01, 0x02, 0x21,
            0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFC, 0x2F,
            0x30, 0x06, 0x04, 0x01, 0x00, 0x04, 0x01, 0x07, 0x04, 0x41, 0x04,
            0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC, 0x55, 0xA0, 0x62,
            0x95, 0xCE, 0x87, 0x0B, 0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE,
            0x28, 0xD9, 0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17, 0x98, 0x48,
            0x3A, 0xDA, 0x77, 0x26, 0xA3, 0xC4, 0x65, 0x5D, 0xA4, 0xFB, 0xFC,
            0x0E, 0x11, 0x08, 0xA8, 0xFD, 0x17, 0xB4, 0x48, 0xA6, 0x85, 0x54,
            0x19, 0x9C, 0x47, 0xD0, 0x8F, 0xFB, 0x10, 0xD4, 0xB8, 0x02, 0x21,
            0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xBA, 0xAE, 0xDC, 0xE6, 0xAF,
            0x48, 0xA0, 0x3B, 0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41,
            0x02, 0x01, 0x01, 0xA1, 0x44, 0x03, 0x42, 0x00};
        uint8_t *ptr = privkey;
        memcpy(ptr, begin, sizeof(begin));
        ptr += sizeof(begin);
        memcpy(ptr, key32, 32);
        ptr += 32;
        memcpy(ptr, middle, sizeof(middle));
        ptr += sizeof(middle);
        pubkeylen = CPubKey::SIZE;
        secp256k1_ec_pubkey_serialize(ctx, ptr, &pubkeylen, &pubkey,
                                      SECP256K1_EC_UNCOMPRESSED);
        ptr += pubkeylen;
        *privkeylen = ptr - privkey;
        assert(*privkeylen == CKey::SIZE);
    }
    return 1;
}

bool CKey::Check(const uint8_t *vch) {
    return secp256k1_ec_seckey_verify(secp256k1_context_sign, vch);
}

void CKey::MakeNewKey(bool fCompressedIn) {
    do {
        GetStrongRandBytes(keydata.data(), keydata.size());
    } while (!Check(keydata.data()));
    fValid = true;
    fCompressed = fCompressedIn;
}

bool CKey::Negate() {
    assert(fValid);
    return secp256k1_ec_privkey_negate(secp256k1_context_sign, keydata.data());
}

CPrivKey CKey::GetPrivKey() const {
    assert(fValid);
    CPrivKey privkey;
    int ret;
    size_t privkeylen;
    privkey.resize(SIZE);
    privkeylen = SIZE;
    ret = ec_privkey_export_der(secp256k1_context_sign, privkey.data(),
                                &privkeylen, begin(), fCompressed);
    assert(ret);
    privkey.resize(privkeylen);
    return privkey;
}

CPubKey CKey::GetPubKey() const {
    assert(fValid);
    secp256k1_pubkey pubkey;
    size_t clen = CPubKey::SIZE;
    CPubKey result;
    int ret =
        secp256k1_ec_pubkey_create(secp256k1_context_sign, &pubkey, begin());
    assert(ret);
    secp256k1_ec_pubkey_serialize(
        secp256k1_context_sign, (uint8_t *)result.begin(), &clen, &pubkey,
        fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
    assert(result.size() == clen);
    assert(result.IsValid());
    return result;
}

// Check that the sig has a low R value and will be less than 71 bytes
static bool SigHasLowR(const secp256k1_ecdsa_signature *sig) {
    uint8_t compact_sig[64];
    secp256k1_ecdsa_signature_serialize_compact(secp256k1_context_sign,
                                                compact_sig, sig);

    // In DER serialization, all values are interpreted as big-endian, signed
    // integers. The highest bit in the integer indicates its signed-ness; 0 is
    // positive, 1 is negative. When the value is interpreted as a negative
    // integer, it must be converted to a positive value by prepending a 0x00
    // byte so that the highest bit is 0. We can avoid this prepending by
    // ensuring that our highest bit is always 0, and thus we must check that
    // the first byte is less than 0x80.
    return compact_sig[0] < 0x80;
}

bool CKey::SignECDSA(const uint256 &hash, std::vector<uint8_t> &vchSig,
                     bool grind, uint32_t test_case) const {
    if (!fValid) {
        return false;
    }
    vchSig.resize(CPubKey::SIGNATURE_SIZE);
    size_t nSigLen = CPubKey::SIGNATURE_SIZE;
    uint8_t extra_entropy[32] = {0};
    WriteLE32(extra_entropy, test_case);
    secp256k1_ecdsa_signature sig;
    uint32_t counter = 0;
    int ret =
        secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(),
                             begin(), secp256k1_nonce_function_rfc6979,
                             (!grind && test_case) ? extra_entropy : nullptr);

    // Grind for low R
    while (ret && !SigHasLowR(&sig) && grind) {
        WriteLE32(extra_entropy, ++counter);
        ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(),
                                   begin(), secp256k1_nonce_function_rfc6979,
                                   extra_entropy);
    }
    assert(ret);
    secp256k1_ecdsa_signature_serialize_der(secp256k1_context_sign,
                                            vchSig.data(), &nSigLen, &sig);
    vchSig.resize(nSigLen);
    return true;
}

static bool DoSignSchnorr(const CKey &key, const uint256 &hash, uint8_t *buf,
                          uint32_t test_case) {
    if (!key.IsValid()) {
        return false;
    }

    uint8_t extra_entropy[32] = {0};
    WriteLE32(extra_entropy, test_case);

    int ret = secp256k1_schnorr_sign(
        secp256k1_context_sign, buf, hash.begin(), key.begin(),
        secp256k1_nonce_function_rfc6979, test_case ? extra_entropy : nullptr);
    assert(ret);
    return true;
}

bool CKey::SignSchnorr(const uint256 &hash,
                       std::array<uint8_t, CPubKey::SCHNORR_SIZE> &sig,
                       uint32_t test_case) const {
    return DoSignSchnorr(*this, hash, sig.data(), test_case);
}

bool CKey::SignSchnorr(const uint256 &hash, std::vector<uint8_t> &vchSig,
                       uint32_t test_case) const {
    if (!fValid) {
        return false;
    }
    vchSig.resize(CPubKey::SCHNORR_SIZE);
    return DoSignSchnorr(*this, hash, vchSig.data(), test_case);
}

bool CKey::VerifyPubKey(const CPubKey &pubkey) const {
    if (pubkey.IsCompressed() != fCompressed) {
        return false;
    }
    uint8_t rnd[8];
    std::string str = "Bitcoin key verification\n";
    GetRandBytes(rnd, sizeof(rnd));
    uint256 hash;
    CHash256()
        .Write((uint8_t *)str.data(), str.size())
        .Write(rnd, sizeof(rnd))
        .Finalize(hash.begin());
    std::vector<uint8_t> vchSig;
    SignECDSA(hash, vchSig);
    return pubkey.VerifyECDSA(hash, vchSig);
}

bool CKey::SignCompact(const uint256 &hash,
                       std::vector<uint8_t> &vchSig) const {
    if (!fValid) {
        return false;
    }
    vchSig.resize(CPubKey::COMPACT_SIGNATURE_SIZE);
    int rec = -1;
    secp256k1_ecdsa_recoverable_signature sig;
    int ret = secp256k1_ecdsa_sign_recoverable(
        secp256k1_context_sign, &sig, hash.begin(), begin(),
        secp256k1_nonce_function_rfc6979, nullptr);
    assert(ret);
    ret = secp256k1_ecdsa_recoverable_signature_serialize_compact(
        secp256k1_context_sign, &vchSig[1], &rec, &sig);
    assert(ret);
    assert(rec != -1);
    vchSig[0] = 27 + rec + (fCompressed ? 4 : 0);
    return true;
}

bool CKey::Load(const CPrivKey &privkey, const CPubKey &vchPubKey,
                bool fSkipCheck = false) {
    if (!ec_privkey_import_der(secp256k1_context_sign, (uint8_t *)begin(),
                               privkey.data(), privkey.size())) {
        return false;
    }
    fCompressed = vchPubKey.IsCompressed();
    fValid = true;

    if (fSkipCheck) {
        return true;
    }

    return VerifyPubKey(vchPubKey);
}

bool CKey::Derive(CKey &keyChild, ChainCode &ccChild, unsigned int nChild,
                  const ChainCode &cc) const {
    assert(IsValid());
    assert(IsCompressed());
    std::vector<uint8_t, secure_allocator<uint8_t>> vout(64);
    if ((nChild >> 31) == 0) {
        CPubKey pubkey = GetPubKey();
        assert(pubkey.size() == CPubKey::COMPRESSED_SIZE);
        BIP32Hash(cc, nChild, *pubkey.begin(), pubkey.begin() + 1, vout.data());
    } else {
        assert(size() == 32);
        BIP32Hash(cc, nChild, 0, begin(), vout.data());
    }
    memcpy(ccChild.begin(), vout.data() + 32, 32);
    memcpy((uint8_t *)keyChild.begin(), begin(), 32);
    bool ret = secp256k1_ec_privkey_tweak_add(
        secp256k1_context_sign, (uint8_t *)keyChild.begin(), vout.data());
    keyChild.fCompressed = true;
    keyChild.fValid = ret;
    return ret;
}

bool CExtKey::Derive(CExtKey &out, unsigned int _nChild) const {
    out.nDepth = nDepth + 1;
    CKeyID id = key.GetPubKey().GetID();
    memcpy(&out.vchFingerprint[0], &id, 4);
    out.nChild = _nChild;
    return key.Derive(out.key, out.chaincode, _nChild, chaincode);
}

void CExtKey::SetSeed(const uint8_t *seed, unsigned int nSeedLen) {
    static const uint8_t hashkey[] = {'B', 'i', 't', 'c', 'o', 'i',
                                      'n', ' ', 's', 'e', 'e', 'd'};
    std::vector<uint8_t, secure_allocator<uint8_t>> vout(64);
    CHMAC_SHA512(hashkey, sizeof(hashkey))
        .Write(seed, nSeedLen)
        .Finalize(vout.data());
    key.Set(vout.data(), vout.data() + 32, true);
    memcpy(chaincode.begin(), vout.data() + 32, 32);
    nDepth = 0;
    nChild = 0;
    memset(vchFingerprint, 0, sizeof(vchFingerprint));
}

CExtPubKey CExtKey::Neuter() const {
    CExtPubKey ret;
    ret.nDepth = nDepth;
    memcpy(&ret.vchFingerprint[0], &vchFingerprint[0], 4);
    ret.nChild = nChild;
    ret.pubkey = key.GetPubKey();
    ret.chaincode = chaincode;
    return ret;
}

void CExtKey::Encode(uint8_t code[BIP32_EXTKEY_SIZE]) const {
    code[0] = nDepth;
    memcpy(code + 1, vchFingerprint, 4);
    code[5] = (nChild >> 24) & 0xFF;
    code[6] = (nChild >> 16) & 0xFF;
    code[7] = (nChild >> 8) & 0xFF;
    code[8] = (nChild >> 0) & 0xFF;
    memcpy(code + 9, chaincode.begin(), 32);
    code[41] = 0;
    assert(key.size() == 32);
    memcpy(code + 42, key.begin(), 32);
}

void CExtKey::Decode(const uint8_t code[BIP32_EXTKEY_SIZE]) {
    nDepth = code[0];
    memcpy(vchFingerprint, code + 1, 4);
    nChild = (code[5] << 24) | (code[6] << 16) | (code[7] << 8) | code[8];
    memcpy(chaincode.begin(), code + 9, 32);
    key.Set(code + 42, code + BIP32_EXTKEY_SIZE, true);
}

bool ECC_InitSanityCheck() {
    CKey key;
    key.MakeNewKey(true);
    CPubKey pubkey = key.GetPubKey();
    return key.VerifyPubKey(pubkey);
}

void ECC_Start() {
    assert(secp256k1_context_sign == nullptr);

    secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN);
    assert(ctx != nullptr);

    {
        // Pass in a random blinding seed to the secp256k1 context.
        std::vector<uint8_t, secure_allocator<uint8_t>> vseed(32);
        GetRandBytes(vseed.data(), 32);
        bool ret = secp256k1_context_randomize(ctx, vseed.data());
        assert(ret);
    }

    secp256k1_context_sign = ctx;
}

void ECC_Stop() {
    secp256k1_context *ctx = secp256k1_context_sign;
    secp256k1_context_sign = nullptr;

    if (ctx) {
        secp256k1_context_destroy(ctx);
    }
}