aboutsummaryrefslogtreecommitdiff
path: root/src/key.cpp
AgeCommit message (Collapse)Author
2023-06-23Add ElligatorSwift key creation and ECDH logicPieter Wuille
Co-authored-by: Dhruv Mehta <856960+dhruv@users.noreply.github.com>
2023-01-31refactor: use `Hash` helper for double-SHA256 calculationsSebastian Falbesoner
2023-01-13Merge bitcoin/bitcoin#26691: Update secp256k1 subtree to libsecp256k1 ↵fanquake
version 0.2.0 202291722300b86f36e97de7960d40a32544c2d1 Add secp256k1_selftest call (Pieter Wuille) 3bfca788b0dae879bfc745cc52c2cb6edc49fd70 Remove explicit enabling of default modules (Pieter Wuille) 4462cb04986d77eddcfc6e8f75e04dc278a8147a Adapt to libsecp256k1 API changes (Pieter Wuille) 9d47e7b71b2805430e8c7b43816efd225a6ccd8c Squashed 'src/secp256k1/' changes from 44c2452fd3..21ffe4b22a (Pieter Wuille) Pull request description: Now that libsecp256k1 has a release (https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-December/021271.html), update the subtree to match it. The changes themselves are not very impactful for Bitcoin Core, but include: * It's no longer needed to specify whether contexts are for signing or verification or both (all contexts support everything), so make use of that in this PR. * Verification operations can use the static context now, removing the need for some infrastructure in pubkey.cpp to make sure a context exists. * Most modules are now enabled by default, so we can drop explicit enabling for them. * CI improvements (in particular, MSVC and more recent MacOS) * Introduction of an internal int128 type, which has no effect for GCC/Clang builds, but enables 128-bit multiplication in MSVC, giving a ~20% speedup there (but still slower than GCC/Clang). * Release process changes (process documentation, changelog, ...). ACKs for top commit: Sjors: ACK 202291722300b86f36e97de7960d40a32544c2d1, but 4462cb04986d77eddcfc6e8f75e04dc278a8147a could use more eyes on it. achow101: ACK 202291722300b86f36e97de7960d40a32544c2d1 jonasnick: utACK 202291722300b86f36e97de7960d40a32544c2d1 Tree-SHA512: 8a9fe28852abe74abd6f96fef16a94d5a427b1d99bff4caab1699014d24698aab9b966a5364a46ed1001c07a7c1d825154ed4e6557c7decce952b77330a8616b
2022-12-24scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: - 2021: f47dda2c58b5d8d623e0e7ff4e74bc352dfa83d7 - 2020: fa0074e2d82928016a43ca408717154a1c70a4db - 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2022-12-13Adapt to libsecp256k1 API changesPieter Wuille
* Use SECP256K1_CONTEXT_NONE when creating signing context, as SECP256K1_CONTEXT_SIGN is deprecated and unnecessary. * Use secp256k1_static_context where applicable.
2022-08-04extended keys: fail to derive too large depth instead of wrapping aroundAntoine Poinsot
This issue was reported to me by Marco Falke, and found with the descriptor_parse fuzz target.
2022-04-27refactor: Use Span of std::byte in CExtKey::SetSeedMarcoFalke
2022-04-21Merge bitcoin/bitcoin#24213: refactor: use Span in random.*laanwj
3ae7791bcaa88f5c68592673b8926ee807242ce7 refactor: use Span in random.* (pasta) Pull request description: ~This PR does two things~ 1. use a Span<unsigned char> for GetRandBytes and GetStrongRandBytes ~2. make GetRand a template for which any integral type can be used, where the default behavior is to return a random integral up to the max of the integral unless a max is provided. This simplifies a lot of code from `GetRand(std::numeric_limits<uint64_t>::max()` -> `GetRand<uint64_t>()`~ MarcoFalke this was inspired by your comment here: https://github.com/bitcoin/bitcoin/pull/24185#issuecomment-1025514263 about using Span, so hopefully I'll be able to get this PR done and merged 😂 ~Also, if requested I could revert the `GetRand(std::numeric_limits<uint64_t>::max()` -> `GetRand<uint64_t>()` related changes if it ends up causing too many conflicts~ ACKs for top commit: laanwj: Thank you! Code review re-ACK 3ae7791bcaa88f5c68592673b8926ee807242ce7 Tree-SHA512: 12375a83b68b288916ba0de81cfcab4aac14389a66a36811ae850427435eb67dd55e47df9ac3ec47db4e214f4330139e548bec815fff8a3f571484ea558dca79
2022-04-07key: use secp256k1_schnorrsig_sign32 over deprecated secp256k1_schnorrsig_signfanquake
The renaming occured in https://github.com/bitcoin-core/secp256k1/pull/1089.
2022-03-23refactor: use Span in random.*pasta
2021-12-30scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: fa0074e2d82928016a43ca408717154a1c70a4db * 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2021-12-15Remove unnecessary cast in CKey::SignSchnorrPieter Wuille
2021-11-12Make signing follow BIP340 exactly w.r.t. aux randomnessPieter Wuille
libsecp256k1's secp256k1_schnorrsig_sign only follows BIP340 exactly if an aux_rand32 argument is passed. When no randomness is used (as is the case in the current codebase here), there is no impact on security between not providing aux_rand32 at all, or providing an empty one. Yet, for repeatability/testability it is simpler to always use an all-zero one.
2021-11-09Merge bitcoin/bitcoin#22934: Add verification to `Sign`, `SignCompact` and ↵W. J. van der Laan
`SignSchnorr` 79fd28cacbbcb86ea03d3d468845001f84a76de3 Adds verification step to Schnorr and ECDSA signing (amadeuszpawlik) Pull request description: As detailed in #22435, BIP340 defines that during Schnorr signing a verification should be done. This is so that potentially corrupt signage does not leak information about private keys used during the process. This is not followed today as no such verification step is being done. The same is valid for ECDSA signing functions `Sign` and `SignCompact`. This PR adds this missing verification step to `SignSchnorr`, `Sign` and `SignCompact`. ACKs for top commit: sipa: utACK 79fd28cacbbcb86ea03d3d468845001f84a76de3 laanwj: Code review ACK 79fd28cacbbcb86ea03d3d468845001f84a76de3 theStack: re-ACK 79fd28cacbbcb86ea03d3d468845001f84a76de3 Tree-SHA512: 8fefa26caea577ae8631cc16c4e2f4cc6cfa1c7cf51d45a4a34165636ee290950617a17a19b4237c6f7a841db0e40fd5c36ad12ef43da82507c0e9fb9375ab82
2021-11-02Adds verification step to Schnorr and ECDSA signingamadeuszpawlik
As defined in BIP340, a verification step should be executed after `secp256k1_schnorrsig_sign` to ensure that a potentially corrupted signature isn't used; using corrupted signatures could reveal information about the private key used. This applies to ECSDA as well. Additionally clears schnorr signature if signing failed.
2021-11-01refactor: Take Span in SetSeedMarcoFalke
This makes calling code less verbose and less fragile. Also, by adding the CKey::data() member function, it is now possible to call HexStr() with a CKey object.
2021-10-05refactor: use `{Read,Write}BE32` helpers for BIP32 nChild (de)serializationSebastian Falbesoner
2021-08-30Stricter BIP32 decoding and test vector 5Pieter Wuille
2021-07-14Update secp256k1 subtree to latest upstream + adapt APIPieter Wuille
The new schnorrsig API requires changing a few arguments.
2021-06-12Add CKey::SignSchnorr function for BIP 340/341 signingPieter Wuille
2021-05-04refactor: Avoid &foo[0] on C-Style arraysMarcoFalke
This is confusing at best when parts of a class use the redundant operators and other parts do not.
2021-01-04doc: Use https URLs where possibleSawyer Billings
2020-12-31scripted-diff: Bump copyright headersMarcoFalke
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT-
2020-08-18tests: Add fuzzing harness for ec_seckey_import_der(...) and ↵practicalswift
ec_seckey_export_der(...)
2020-07-30Make CHash256/CHash160 output to SpanPieter Wuille
2020-07-30Make CHash256 and CHash160 consume SpansPieter Wuille
2020-06-10scripted-diff: rename privkey with seckey in secp256k1 interfacePieter Wuille
-BEGIN VERIFY SCRIPT- sed -i 's/privkey/seckey/g' src/key.cpp -END VERIFY SCRIPT-
2019-12-30scripted-diff: Bump copyright of files changed in 2019MarcoFalke
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT-
2019-11-20Merge #12461: scripted-diff: Rename key size consts to be relative to their ↵Wladimir J. van der Laan
class 0580f86bb48004b797d4cb6273e7ffee0b0a0584 Fixup whitespace (Ben Woosley) 47101bbb27d0e13ea2b40ce1c7ff0dba9030f369 scripted-diff: Rename CPubKey and CKey::*_KEY_SIZE and COMPRESSED_*_KEY_SIZE (Ben Woosley) Pull request description: ~~And introduce CPubKeySig to host code relative to key sigs.~~ ACKs for top commit: meshcollider: utACK https://github.com/bitcoin/bitcoin/pull/12461/commits/0580f86bb48004b797d4cb6273e7ffee0b0a0584 Tree-SHA512: 29aa0be54912358b138e391b9db78639786f56580493e590ec9f773c0e1b421740133d05a79be247c7ee57e71c9c9e41b9cb54088cb3c0e3f813f74f0895287b
2019-06-02Make reasoning about dependencies easier by not including unused dependenciespracticalswift
2019-03-27CKey: add method to negate the keyJonas Schnelli
2019-03-04scripted-diff: Rename CPubKey and CKey::*_KEY_SIZE and COMPRESSED_*_KEY_SIZEBen Woosley
To SIZE and COMPRESSED_SIZE -BEGIN VERIFY SCRIPT- sed -i 's/PRIVATE_KEY_SIZE/SIZE/g' src/*.h src/*.cpp src/**/*.h src/**/*.cpp sed -i 's/COMPRESSED_PRIVATE_KEY_SIZE/COMPRESSED_SIZE/g' src/*.h src/**/*.cpp src/**/*.h src/**/*.cpp sed -i 's/PUBLIC_KEY_SIZE/SIZE/g' src/*.h src/*.cpp src/**/*.h src/**/*.cpp sed -i 's/COMPRESSED_PUBLIC_KEY_SIZE/COMPRESSED_SIZE/g' src/*.h src/*.cpp src/**/*.h src/**/*.cpp -END VERIFY SCRIPT-
2019-01-31Fix assertion in CKey::SignCompactJoão Barbosa
2018-09-13Pass export privkey DER compression flag correctlyliuyujun
By passing a bitfield where a boolean was expected, the result was always compressed. Fix this.
2018-08-13Merge #13666: Always create signatures with Low R valuesWladimir J. van der Laan
e306be742932d4ea5aca0ea4768e54b2fc3dc6a0 Use 72 byte dummy signatures when watching only inputs may be used (Andrew Chow) 48b1473c898129a99212e2db36c61cf93625ea17 Use 71 byte signature for DUMMY_SIGNATURE_CREATOR (Andrew Chow) 18dfea0dd082af18dfb02981b7ee1cd44d514388 Always create 70 byte signatures with low R values (Andrew Chow) Pull request description: When creating signatures for transactions, always make one which has a 32 byte or smaller R and 32 byte or smaller S value. This results in signatures that are always less than 71 bytes (32 byte R + 32 byte S + 6 bytes DER + 1 byte sighash) with low R values. In most cases, the signature will be 71 bytes. Because R is not mutable in the same way that S is, a low R value can only be found by trying different nonces. RFC 6979 for deterministic nonce generation has the option to specify additional entropy, so we simply use that and add a uin32_t counter which we increment in order to try different nonces. Nonces are sill deterministically generated as the nonce used will the be the first one where the counter results in a nonce that results in a low R value. Because different nonces need to be tried, time to produce a signature does increase. On average, it takes twice as long to make a signature as two signatures need to be created, on average, to find one with a low R. Having a fixed size signature makes size calculations easier and also saves half a byte of transaction size, on average. DUMMY_SIGNATURE_CREATOR has been modified to produce 71 byte dummy signatures instead of 72 byte signatures. Tree-SHA512: 3cd791505126ce92da7c631856a97ba0b59e87d9c132feff6e0eef1dc47768e81fbb38bfbe970371bedf9714b7f61a13a5fe9f30f962c81734092a4d19a4ef33
2018-08-09Always create 70 byte signatures with low R valuesAndrew Chow
When extra entropy is not specified by the caller, CKey::Sign will now always create a signature that has a low R value and is at most 70 bytes. The resulting signature on the stack will be 71 bytes when the sighash byte is included. Using low R signatures means that the resulting DER encoded signature will never need to have additional padding to account for high R values.
2018-07-27Update copyright headers to 2018DrahtBot
2018-05-19scripted-diff: Rename master key to seedJohn Newbery
-BEGIN VERIFY SCRIPT- ren() { git grep -l "\<$1\>" 'src/*.cpp' 'src/*.h' test | xargs sed -i "s:\<$1\>:$2:g"; } ren GenerateNewHDMasterKey GenerateNewSeed ren DeriveNewMasterHDKey DeriveNewSeed ren SetHDMasterKey SetHDSeed ren hdMasterKeyID hd_seed_id ren masterKeyID seed_id ren SetMaster SetSeed ren hdmasterkeyid hdseedid ren hdmaster hdseed -END VERIFY SCRIPT-
2018-03-07Merge #9598: Improve readability by removing redundant casts to same type ↵Wladimir J. van der Laan
(on all platforms) 06edc23f7 Improve readability by removing redundant casts to same type (on all platforms) (practicalswift) Pull request description: Same binaries check under Linux: ``` $ ../bitcoin-maintainer-tools/build-for-compare.py 874f13821f4193bd037cd37d005ee76b5a849398 82274c02ed2d82537dc55f008a29edb1bc09bbc4 --executables "src/bitcoind,src/bitcoin-cli,src/bitcoin-tx" $ sha256sum /tmp/compare/*.stripped 1fe1a8827474f7f24475ce3dc851e7ac658d4ed0ae38d11e67f5a810671eaa15 /tmp/compare/bitcoin-cli.82274c02ed2d82537dc55f008a29edb1bc09bbc4.stripped 1fe1a8827474f7f24475ce3dc851e7ac658d4ed0ae38d11e67f5a810671eaa15 /tmp/compare/bitcoin-cli.874f13821f4193bd037cd37d005ee76b5a849398.stripped 342c2ed0e60b60990a58cbf5845b256a4f9e3baff9db074baba5e34a620a60ea /tmp/compare/bitcoind.82274c02ed2d82537dc55f008a29edb1bc09bbc4.stripped 342c2ed0e60b60990a58cbf5845b256a4f9e3baff9db074baba5e34a620a60ea /tmp/compare/bitcoind.874f13821f4193bd037cd37d005ee76b5a849398.stripped e4b2a80b2361d5cefd67a47eeb9298b8b712c26c7779d979348be8b2c7e3ec93 /tmp/compare/bitcoin-tx.82274c02ed2d82537dc55f008a29edb1bc09bbc4.stripped e4b2a80b2361d5cefd67a47eeb9298b8b712c26c7779d979348be8b2c7e3ec93 /tmp/compare/bitcoin-tx.874f13821f4193bd037cd37d005ee76b5a849398.stripped $ git diff -W --word-diff /tmp/compare/874f13821f4193bd037cd37d005ee76b5a849398 /tmp/compare/82274c02ed2d82537dc55f008a29edb1bc09bbc4 $ ``` Tree-SHA512: 13ca5862fbb03771682b04a7523e581a7fe62e73620fa0e141cf1bc0a3b3f4e2e66bf14b46d1228e2b11b4960153545e7476f3295713a69b5cf5a28a7c2b358d
2018-02-05Use ptrdiff_t type to more precisely indicate usage and avoid compiler warnings.murrayn
2018-01-23Make CKey::Load references constRussell Yanofsky
No change in behavior, this just prevents CKey::Load arguments from looking like outputs.
2018-01-03Increment MIT Licence copyright header year on files modified in 2017Akira Takizawa
2017-12-21Improve readability by removing redundant casts to same type (on all platforms)practicalswift
2017-12-20Merge #10657: Utils: Improvements to ECDSA key-handling codeWladimir J. van der Laan
63179d0 Scope the ECDSA constant sizes to CPubKey / CKey classes (Jack Grigg) 1ce9f0a Ensure that ECDSA constant sizes are correctly-sized (Jack Grigg) 48abe78 Remove redundant `= 0` initialisations (Jack Grigg) 17fa391 Specify ECDSA constant sizes as constants (Jack Grigg) e4a1086 Update Debian copyright list (Jack Grigg) e181dbe Add comments (Jack Grigg) a3603ac Fix potential overflows in ECDSA DER parsers (Jack Grigg) Pull request description: Mostly trivial, but includes fixes to potential overflows in the ECDSA DER parsers. Cherry-picked from Zcash PR https://github.com/zcash/zcash/pull/2335 Tree-SHA512: 8fcbd51b0bd6723e5d33fa5d592f7cb68ed182796a9b837ecc8217991ad69d6c970258617dc00eb378c8caa4cec5d6b304d9d2c066acd40cda98e4da68e0caa4
2017-11-16Remove includes in .cpp files for things the corresponding .h file already ↵practicalswift
included
2017-11-16scripted-diff: Replace #include "" with #include <> (ryanofsky)MeshCollider
-BEGIN VERIFY SCRIPT- for f in \ src/*.cpp \ src/*.h \ src/bench/*.cpp \ src/bench/*.h \ src/compat/*.cpp \ src/compat/*.h \ src/consensus/*.cpp \ src/consensus/*.h \ src/crypto/*.cpp \ src/crypto/*.h \ src/crypto/ctaes/*.h \ src/policy/*.cpp \ src/policy/*.h \ src/primitives/*.cpp \ src/primitives/*.h \ src/qt/*.cpp \ src/qt/*.h \ src/qt/test/*.cpp \ src/qt/test/*.h \ src/rpc/*.cpp \ src/rpc/*.h \ src/script/*.cpp \ src/script/*.h \ src/support/*.cpp \ src/support/*.h \ src/support/allocators/*.h \ src/test/*.cpp \ src/test/*.h \ src/wallet/*.cpp \ src/wallet/*.h \ src/wallet/test/*.cpp \ src/wallet/test/*.h \ src/zmq/*.cpp \ src/zmq/*.h do base=${f%/*}/ relbase=${base#src/} sed -i "s:#include \"\(.*\)\"\(.*\):if test -e \$base'\\1'; then echo \"#include <\"\$relbase\"\\1>\\2\"; else echo \"#include <\\1>\\2\"; fi:e" $f done -END VERIFY SCRIPT-
2017-10-04Scope the ECDSA constant sizes to CPubKey / CKey classesJack Grigg
2017-08-07scripted-diff: Use the C++11 keyword nullptr to denote the pointer literal ↵practicalswift
instead of the macro NULL -BEGIN VERIFY SCRIPT- sed -i 's/\<NULL\>/nullptr/g' src/*.cpp src/*.h src/*/*.cpp src/*/*.h src/qt/*/*.cpp src/qt/*/*.h src/wallet/*/*.cpp src/wallet/*/*.h src/support/allocators/*.h sed -i 's/Prefer nullptr, otherwise SAFECOOKIE./Prefer NULL, otherwise SAFECOOKIE./g' src/torcontrol.cpp sed -i 's/tor: Using nullptr authentication/tor: Using NULL authentication/g' src/torcontrol.cpp sed -i 's/METHODS=nullptr/METHODS=NULL/g' src/test/torcontrol_tests.cpp src/torcontrol.cpp sed -i 's/nullptr certificates/NULL certificates/g' src/qt/paymentserver.cpp sed -i 's/"nullptr"/"NULL"/g' src/torcontrol.cpp src/test/torcontrol_tests.cpp -END VERIFY SCRIPT-
2017-07-17Ensure that ECDSA constant sizes are correctly-sizedJack Grigg
2017-07-17Remove redundant `= 0` initialisationsJack Grigg
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-06 06:13:46 +0000