1 // Copyright (c) 2009-2016 The Bitcoin Core developers
2 // Distributed under the MIT software license, see the accompanying
3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
7 #include <arith_uint256.h>
8 #include <crypto/common.h>
9 #include <crypto/hmac_sha512.h>
12 #include <secp256k1.h>
13 #include <secp256k1_recovery.h>
15 static secp256k1_context
* secp256k1_context_sign
= nullptr;
17 /** These functions are taken from the libsecp256k1 distribution and are very ugly. */
18 static int ec_privkey_import_der(const secp256k1_context
* ctx
, unsigned char *out32
, const unsigned char *privkey
, size_t privkeylen
) {
19 const unsigned char *end
= privkey
+ privkeylen
;
24 if (end
< privkey
+1 || *privkey
!= 0x30) {
28 /* sequence length constructor */
29 if (end
< privkey
+1 || !(*privkey
& 0x80)) {
32 lenb
= *privkey
& ~0x80; privkey
++;
33 if (lenb
< 1 || lenb
> 2) {
36 if (end
< privkey
+lenb
) {
40 len
= privkey
[lenb
-1] | (lenb
> 1 ? privkey
[lenb
-2] << 8 : 0);
42 if (end
< privkey
+len
) {
45 /* sequence element 0: version number (=1) */
46 if (end
< privkey
+3 || privkey
[0] != 0x02 || privkey
[1] != 0x01 || privkey
[2] != 0x01) {
50 /* sequence element 1: octet string, up to 32 bytes */
51 if (end
< privkey
+2 || privkey
[0] != 0x04 || privkey
[1] > 0x20 || end
< privkey
+2+privkey
[1]) {
54 memcpy(out32
+ 32 - privkey
[1], privkey
+ 2, privkey
[1]);
55 if (!secp256k1_ec_seckey_verify(ctx
, out32
)) {
62 static int ec_privkey_export_der(const secp256k1_context
*ctx
, unsigned char *privkey
, size_t *privkeylen
, const unsigned char *key32
, int compressed
) {
63 secp256k1_pubkey pubkey
;
65 if (!secp256k1_ec_pubkey_create(ctx
, &pubkey
, key32
)) {
70 static const unsigned char begin
[] = {
71 0x30,0x81,0xD3,0x02,0x01,0x01,0x04,0x20
73 static const unsigned char middle
[] = {
74 0xA0,0x81,0x85,0x30,0x81,0x82,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
75 0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
76 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
77 0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
78 0x21,0x02,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
79 0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
80 0x17,0x98,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
81 0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
82 0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x24,0x03,0x22,0x00
84 unsigned char *ptr
= privkey
;
85 memcpy(ptr
, begin
, sizeof(begin
)); ptr
+= sizeof(begin
);
86 memcpy(ptr
, key32
, 32); ptr
+= 32;
87 memcpy(ptr
, middle
, sizeof(middle
)); ptr
+= sizeof(middle
);
89 secp256k1_ec_pubkey_serialize(ctx
, ptr
, &pubkeylen
, &pubkey
, SECP256K1_EC_COMPRESSED
);
91 *privkeylen
= ptr
- privkey
;
93 static const unsigned char begin
[] = {
94 0x30,0x82,0x01,0x13,0x02,0x01,0x01,0x04,0x20
96 static const unsigned char middle
[] = {
97 0xA0,0x81,0xA5,0x30,0x81,0xA2,0x02,0x01,0x01,0x30,0x2C,0x06,0x07,0x2A,0x86,0x48,
98 0xCE,0x3D,0x01,0x01,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
99 0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
100 0xFF,0xFF,0xFE,0xFF,0xFF,0xFC,0x2F,0x30,0x06,0x04,0x01,0x00,0x04,0x01,0x07,0x04,
101 0x41,0x04,0x79,0xBE,0x66,0x7E,0xF9,0xDC,0xBB,0xAC,0x55,0xA0,0x62,0x95,0xCE,0x87,
102 0x0B,0x07,0x02,0x9B,0xFC,0xDB,0x2D,0xCE,0x28,0xD9,0x59,0xF2,0x81,0x5B,0x16,0xF8,
103 0x17,0x98,0x48,0x3A,0xDA,0x77,0x26,0xA3,0xC4,0x65,0x5D,0xA4,0xFB,0xFC,0x0E,0x11,
104 0x08,0xA8,0xFD,0x17,0xB4,0x48,0xA6,0x85,0x54,0x19,0x9C,0x47,0xD0,0x8F,0xFB,0x10,
105 0xD4,0xB8,0x02,0x21,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
106 0xFF,0xFF,0xFF,0xFF,0xFE,0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,0xBF,0xD2,0x5E,
107 0x8C,0xD0,0x36,0x41,0x41,0x02,0x01,0x01,0xA1,0x44,0x03,0x42,0x00
109 unsigned char *ptr
= privkey
;
110 memcpy(ptr
, begin
, sizeof(begin
)); ptr
+= sizeof(begin
);
111 memcpy(ptr
, key32
, 32); ptr
+= 32;
112 memcpy(ptr
, middle
, sizeof(middle
)); ptr
+= sizeof(middle
);
114 secp256k1_ec_pubkey_serialize(ctx
, ptr
, &pubkeylen
, &pubkey
, SECP256K1_EC_UNCOMPRESSED
);
116 *privkeylen
= ptr
- privkey
;
121 bool CKey::Check(const unsigned char *vch
) {
122 return secp256k1_ec_seckey_verify(secp256k1_context_sign
, vch
);
125 void CKey::MakeNewKey(bool fCompressedIn
) {
127 GetStrongRandBytes(keydata
.data(), keydata
.size());
128 } while (!Check(keydata
.data()));
130 fCompressed
= fCompressedIn
;
133 CPrivKey
CKey::GetPrivKey() const {
140 ret
= ec_privkey_export_der(secp256k1_context_sign
, (unsigned char*) privkey
.data(), &privkeylen
, begin(), fCompressed
? SECP256K1_EC_COMPRESSED
: SECP256K1_EC_UNCOMPRESSED
);
142 privkey
.resize(privkeylen
);
146 CPubKey
CKey::GetPubKey() const {
148 secp256k1_pubkey pubkey
;
151 int ret
= secp256k1_ec_pubkey_create(secp256k1_context_sign
, &pubkey
, begin());
153 secp256k1_ec_pubkey_serialize(secp256k1_context_sign
, (unsigned char*)result
.begin(), &clen
, &pubkey
, fCompressed
? SECP256K1_EC_COMPRESSED
: SECP256K1_EC_UNCOMPRESSED
);
154 assert(result
.size() == clen
);
155 assert(result
.IsValid());
159 bool CKey::Sign(const uint256
&hash
, std::vector
<unsigned char>& vchSig
, uint32_t test_case
) const {
164 unsigned char extra_entropy
[32] = {0};
165 WriteLE32(extra_entropy
, test_case
);
166 secp256k1_ecdsa_signature sig
;
167 int ret
= secp256k1_ecdsa_sign(secp256k1_context_sign
, &sig
, hash
.begin(), begin(), secp256k1_nonce_function_rfc6979
, test_case
? extra_entropy
: nullptr);
169 secp256k1_ecdsa_signature_serialize_der(secp256k1_context_sign
, (unsigned char*)vchSig
.data(), &nSigLen
, &sig
);
170 vchSig
.resize(nSigLen
);
174 bool CKey::VerifyPubKey(const CPubKey
& pubkey
) const {
175 if (pubkey
.IsCompressed() != fCompressed
) {
178 unsigned char rnd
[8];
179 std::string str
= "Bitcoin key verification\n";
180 GetRandBytes(rnd
, sizeof(rnd
));
182 CHash256().Write((unsigned char*)str
.data(), str
.size()).Write(rnd
, sizeof(rnd
)).Finalize(hash
.begin());
183 std::vector
<unsigned char> vchSig
;
185 return pubkey
.Verify(hash
, vchSig
);
188 bool CKey::SignCompact(const uint256
&hash
, std::vector
<unsigned char>& vchSig
) const {
193 secp256k1_ecdsa_recoverable_signature sig
;
194 int ret
= secp256k1_ecdsa_sign_recoverable(secp256k1_context_sign
, &sig
, hash
.begin(), begin(), secp256k1_nonce_function_rfc6979
, nullptr);
196 secp256k1_ecdsa_recoverable_signature_serialize_compact(secp256k1_context_sign
, (unsigned char*)&vchSig
[1], &rec
, &sig
);
199 vchSig
[0] = 27 + rec
+ (fCompressed
? 4 : 0);
203 bool CKey::Load(CPrivKey
&privkey
, CPubKey
&vchPubKey
, bool fSkipCheck
=false) {
204 if (!ec_privkey_import_der(secp256k1_context_sign
, (unsigned char*)begin(), privkey
.data(), privkey
.size()))
206 fCompressed
= vchPubKey
.IsCompressed();
212 return VerifyPubKey(vchPubKey
);
215 bool CKey::Derive(CKey
& keyChild
, ChainCode
&ccChild
, unsigned int nChild
, const ChainCode
& cc
) const {
217 assert(IsCompressed());
218 std::vector
<unsigned char, secure_allocator
<unsigned char>> vout(64);
219 if ((nChild
>> 31) == 0) {
220 CPubKey pubkey
= GetPubKey();
221 assert(pubkey
.begin() + 33 == pubkey
.end());
222 BIP32Hash(cc
, nChild
, *pubkey
.begin(), pubkey
.begin()+1, vout
.data());
224 assert(begin() + 32 == end());
225 BIP32Hash(cc
, nChild
, 0, begin(), vout
.data());
227 memcpy(ccChild
.begin(), vout
.data()+32, 32);
228 memcpy((unsigned char*)keyChild
.begin(), begin(), 32);
229 bool ret
= secp256k1_ec_privkey_tweak_add(secp256k1_context_sign
, (unsigned char*)keyChild
.begin(), vout
.data());
230 keyChild
.fCompressed
= true;
231 keyChild
.fValid
= ret
;
235 bool CExtKey::Derive(CExtKey
&out
, unsigned int _nChild
) const {
236 out
.nDepth
= nDepth
+ 1;
237 CKeyID id
= key
.GetPubKey().GetID();
238 memcpy(&out
.vchFingerprint
[0], &id
, 4);
239 out
.nChild
= _nChild
;
240 return key
.Derive(out
.key
, out
.chaincode
, _nChild
, chaincode
);
243 void CExtKey::SetMaster(const unsigned char *seed
, unsigned int nSeedLen
) {
244 static const unsigned char hashkey
[] = {'B','i','t','c','o','i','n',' ','s','e','e','d'};
245 std::vector
<unsigned char, secure_allocator
<unsigned char>> vout(64);
246 CHMAC_SHA512(hashkey
, sizeof(hashkey
)).Write(seed
, nSeedLen
).Finalize(vout
.data());
247 key
.Set(vout
.data(), vout
.data() + 32, true);
248 memcpy(chaincode
.begin(), vout
.data() + 32, 32);
251 memset(vchFingerprint
, 0, sizeof(vchFingerprint
));
254 CExtPubKey
CExtKey::Neuter() const {
257 memcpy(&ret
.vchFingerprint
[0], &vchFingerprint
[0], 4);
259 ret
.pubkey
= key
.GetPubKey();
260 ret
.chaincode
= chaincode
;
264 void CExtKey::Encode(unsigned char code
[BIP32_EXTKEY_SIZE
]) const {
266 memcpy(code
+1, vchFingerprint
, 4);
267 code
[5] = (nChild
>> 24) & 0xFF; code
[6] = (nChild
>> 16) & 0xFF;
268 code
[7] = (nChild
>> 8) & 0xFF; code
[8] = (nChild
>> 0) & 0xFF;
269 memcpy(code
+9, chaincode
.begin(), 32);
271 assert(key
.size() == 32);
272 memcpy(code
+42, key
.begin(), 32);
275 void CExtKey::Decode(const unsigned char code
[BIP32_EXTKEY_SIZE
]) {
277 memcpy(vchFingerprint
, code
+1, 4);
278 nChild
= (code
[5] << 24) | (code
[6] << 16) | (code
[7] << 8) | code
[8];
279 memcpy(chaincode
.begin(), code
+9, 32);
280 key
.Set(code
+42, code
+BIP32_EXTKEY_SIZE
, true);
283 bool ECC_InitSanityCheck() {
285 key
.MakeNewKey(true);
286 CPubKey pubkey
= key
.GetPubKey();
287 return key
.VerifyPubKey(pubkey
);
291 assert(secp256k1_context_sign
== nullptr);
293 secp256k1_context
*ctx
= secp256k1_context_create(SECP256K1_CONTEXT_SIGN
);
294 assert(ctx
!= nullptr);
297 // Pass in a random blinding seed to the secp256k1 context.
298 std::vector
<unsigned char, secure_allocator
<unsigned char>> vseed(32);
299 GetRandBytes(vseed
.data(), 32);
300 bool ret
= secp256k1_context_randomize(ctx
, vseed
.data());
304 secp256k1_context_sign
= ctx
;
308 secp256k1_context
*ctx
= secp256k1_context_sign
;
309 secp256k1_context_sign
= nullptr;
312 secp256k1_context_destroy(ctx
);