aboutsummaryrefslogtreecommitdiff
path: root/src/script/sign.cpp
AgeCommit message (Collapse)Author
2024-04-22sign: don't assume we are parsing a sane MiniscriptAntoine Poinsot
The script provided for signature might be externally provided, for instance by way of 'finalizepsbt'. Therefore the script might be ill-crafted, so don't assume pubkeys are always 32 bytes. Thanks to Niklas for finding this.
2023-11-16serialize: Drop useless version param from GetSerializeSize()Anthony Towns
2023-10-12tidy: modernize-use-emplaceMarcoFalke
2023-10-08script/sign: Miniscript support in TapscriptAntoine Poinsot
We make the Satisfier a base in which to store the common methods between the Tapscript and P2WSH satisfier, and from which they both inherit. A field is added to SignatureData to be able to satisfy pkh() under Tapscript context (to get the pubkey hash preimage) without wallet data. For instance in `finalizepsbt` RPC. See also the next commits for a functional test that exercises this.
2023-10-08MOVEONLY: script/sign: move Satisfier declaration above Tapscript signingAntoine Poinsot
We'll need the Miniscript satisfier for Tapscript too.
2023-10-08miniscript: introduce a MsContext() helper to contextsAntoine Poinsot
We are going to introduce Tapscript support in Miniscript, for which some of Miniscript rules and properties change (new or modified fragments, different typing rules, different resources consumption, ..).
2023-08-14Rename script/standard.{cpp/h} to script/solver.{cpp/h}Andrew Chow
Since script/standard only contains things that are used by the Solver and its callers, rename the files to script/solver.
2023-08-14Move CScriptID to script.{h/cpp}Andrew Chow
CScriptID should be next to CScript just as CKeyID is next to CPubKey
2023-02-16Merge bitcoin/bitcoin#24149: Signing support for Miniscript Descriptorsfanquake
6c7a17a8e0eec377f83ed1399f003ae70b898270 psbt: support externally provided preimages for Miniscript satisfaction (Antoine Poinsot) 840a396029316896beda46600aec3c1af09a899c qa: add a "smart" Miniscript fuzz target (Antoine Poinsot) 17e3547241d593bc92c5c6b36c54284d9d9f3feb qa: add a fuzz target generating random nodes from a binary encoding (Antoine Poinsot) 611e12502a5887ffb751bb92fadaa334d484824b qa: functional test Miniscript signing with key and timelocks (Antoine Poinsot) d57b7f2021d2369f6e88cdf0f562aab27c51beaf refactor: make descriptors in Miniscript functional test more readable (Antoine Poinsot) 0a8fc9e200b5018c1efd6f9126eb405ca0beeea3 wallet: check solvability using descriptor in AvailableCoins (Antoine Poinsot) 560e62b1e221832ae99ff8684559a7b8f9df84a7 script/sign: signing support for Miniscripts with hash preimage challenges (Antoine Poinsot) a2f81b6a8f1ff3b0750711409c7538812a52ef40 script/sign: signing support for Miniscript with timelocks (Antoine Poinsot) 61c6d1a8440db09c44d7fd367a6f2c641ea93d40 script/sign: basic signing support for Miniscript descriptors (Antoine Poinsot) 4242c1c52127df3a24be0c15b88d4fc463af04fc Align 'e' property of or_d and andor with website spec (Pieter Wuille) f5deb417804b9f267830bd40177677987df4526d Various additional explanations of the satisfaction logic from Pieter (Pieter Wuille) 22c5b00345063bdeb8b6d3da8b5692d18f92bfb7 miniscript: satisfaction support (Antoine Poinsot) Pull request description: This makes the Miniscript descriptors solvable. Note this introduces signing support for much more complex scripts than the wallet was previously able to solve, and the whole tooling isn't provided for a complete Miniscript integration in the wallet. Particularly, the PSBT<->Miniscript integration isn't entirely covered in this PR. ACKs for top commit: achow101: ACK 6c7a17a8e0eec377f83ed1399f003ae70b898270 sipa: utACK 6c7a17a8e0eec377f83ed1399f003ae70b898270 (to the extent that it's not my own code). Tree-SHA512: a71ec002aaf66bd429012caa338fc58384067bcd2f453a46e21d381ed1bacc8e57afb9db57c0fb4bf40de43b30808815e9ebc0ae1fbd9e61df0e7b91a17771cc
2023-02-11script/sign: signing support for Miniscripts with hash preimage challengesAntoine Poinsot
Preimages must be externally provided (typically, via a PSBT).
2023-02-11script/sign: signing support for Miniscript with timelocksAntoine Poinsot
2023-02-11script/sign: basic signing support for Miniscript descriptorsAntoine Poinsot
Try to solve a script using the Miniscript satisfier if the legacy solver fails under P2WSH context. Only solve public key and public key hash challenges for now. We don't entirely replace the raw solver and especially rule out trying to solve CHECKMULTISIG-based multisigs with the Miniscript satisfier since some features, such as the transaction input combiner, rely on the specific behaviour of the former.
2023-01-30Merge bitcoin/bitcoin#15294: refactor: Extract RipeMd160MarcoFalke
6879be691bf636a53208ef058f2ebe18bfa8017c refactor: Extract RIPEMD160 (Ben Woosley) Pull request description: To directly return a CRIPEMD160 hash from data. Simplifies the call sites. ACKs for top commit: achow101: ACK 6879be691bf636a53208ef058f2ebe18bfa8017c theStack: re-ACK 6879be691bf636a53208ef058f2ebe18bfa8017c MarcoFalke: review ACK 6879be691bf636a53208ef058f2ebe18bfa8017c 🏔 Tree-SHA512: 6ead85d8060c2ac6afd43ec716ff5a82d6754c4132fe7df3b898541fa19f1dfd8b301b2b66ae7cb7594b1b1a8c7f68bce3790a8c610d4a1164e995d89bc5ae34
2023-01-26refactor: Extract RIPEMD160Ben Woosley
To directly return a CRIPEMD160 hash from data. Incidentally, decoding this acronym: * RIPEMD -> RIPE Message Digest * RIPE -> RACE Integrity Primitives Evaluation * RACE -> Research and Development in Advanced Communications Technologies in Europe
2023-01-19Merge bitcoin/bitcoin#25877: refactor: Do not use CScript for tapleaf ↵Andrew Chow
scripts until the tapleaf version is known dee89438b82e94474ebaa31367035f98b4636dac Abstract out ComputeTapbranchHash (Russell O'Connor) 8e3fc9942729716e95907008fcf36eee758c3a6a Do not use CScript for tapleaf scripts until the tapleaf version is known (Russell O'Connor) Pull request description: While BIP-341 calls the contents of tapleaf a "script", only in the case that the tapleaf version is `0xc0` is this script known to be a tapscript. Otherwise the tapleaf "script" is simply an uninterpreted string of bytes. This PR corrects the issue where the type `CScript` is used prior to the tapleaf version being known to be a tapscript. This prevents `CScript` methods from erroneously being called on non-tapscript data. A second commit abstracts out the TapBranch hash computation in the same manner that the TapLeaf computation is already abstracted. These two abstractions ensure that the TapLeaf and TapBranch tagged hashes are always constructed properly. ACKs for top commit: ajtowns: ACK dee89438b82e94474ebaa31367035f98b4636dac instagibbs: ACK dee89438b82e94474ebaa31367035f98b4636dac achow101: ACK dee89438b82e94474ebaa31367035f98b4636dac sipa: ACK dee89438b82e94474ebaa31367035f98b4636dac aureleoules: reACK dee89438b82e94474ebaa31367035f98b4636dac - I verified that there is no behavior change. Tree-SHA512: 4a1d37f3e9a1890e7f5eadcf65562688cc451389581fe6e2da0feb2368708edacdd95392578d8afff05270d88fc61dce732d83d1063d84d12cf47b5f4633ec7e
2022-12-24scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: - 2021: f47dda2c58b5d8d623e0e7ff4e74bc352dfa83d7 - 2020: fa0074e2d82928016a43ca408717154a1c70a4db - 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2022-11-21Do not use CScript for tapleaf scripts until the tapleaf version is knownRussell O'Connor
Prevents use of CScript methods until the tapleaf is known to be a tapscript.
2022-10-28sign: Fill in taproot pubkey info for all script path sigsAndrew Chow
Taproot pubkey info was not being added for multi_a signing. The filling of this info is moved into the common function CreateTaprootScriptSig so that any signing of taproot scripts will include the pubkey info.
2022-08-19Make DUMMY_CHECKER availble outside of script/sign.cppAndrew Chow
2022-08-11Merge bitcoin/bitcoin#25664: refactor: Redefine `IsSolvable()` using descriptorsAndrew Chow
b16f93caddcd3254eaf3dc43e09adf2142a9c40a script/sign: remove needless IsSolvable() utility (Antoine Poinsot) c232ef20c0fd2e3b55355e52684091cad3af5247 outputtype: remove redundant check for uncompressed keys in AddAndGetDestinationForScript (Antoine Poinsot) Pull request description: Now that we have descriptors there is no need to try to sign for a scriptPubKey using dummy signatures, and using a mocked verification of this witness against the interpreter, just to make sure we know how to spend such a Script. Just try to infer a solvable descriptor: any scriptPubKey that we can sign for can be inferred as such. This came up in #24149 but i think it's worth it on its own. ACKs for top commit: instagibbs: ACK https://github.com/bitcoin/bitcoin/pull/25664/commits/b16f93caddcd3254eaf3dc43e09adf2142a9c40a achow101: re-ACK b16f93caddcd3254eaf3dc43e09adf2142a9c40a furszy: ACK b16f93ca, only change is the `IsSolvable` helper function removal. Tree-SHA512: 137068157ce90210b710b1bf9ac3c400e2ff5af1112f892094b69875ea473d6a899f52adb51e5030cb907dee517602059cd1661107808558efa5de842ba12b41
2022-08-11script/sign: remove needless IsSolvable() utilityAntoine Poinsot
It was used back when we didn't have a concept of descriptor. Now we can check for solvability using descriptors.
2022-08-09Merge bitcoin/bitcoin#23480: Add rawtr() descriptor for P2TR with specified ↵Andrew Chow
(tweaked) output key 544b4332f0e122167bdb94dc963405422faa30cb Add wallet tests for spending rawtr() (Pieter Wuille) e1e3081200a71b6c9b0dcf236bc2a37ed1aa7552 If P2TR tweaked key is available, sign with it (Pieter Wuille) 8d9670ccb756592bddb2a269bf5078d62658537b Add rawtr() descriptor for P2TR with unknown tweak (Pieter Wuille) Pull request description: It may be useful to be able to represent P2TR outputs in descriptors whose script tree and/or internal key aren't known. This PR does that, by adding a `rawtr(KEY)` descriptor, where the KEY represents the output key directly. If the private key corresponding to that output key is known, it also permits signing with it. I'm not convinced this is desirable, but presumably "tr(KEY)" sounds more intended for direct use than "rawtr(KEY)". ACKs for top commit: achow101: ACK 544b4332f0e122167bdb94dc963405422faa30cb sanket1729: code review ACK 544b4332f0e122167bdb94dc963405422faa30cb w0xlt: reACK https://github.com/bitcoin/bitcoin/pull/23480/commits/544b4332f0e122167bdb94dc963405422faa30cb Tree-SHA512: 0de08de517468bc22ab0c00db471ce33144f5dc211ebc2974c6ea95709f44e830532ec5cdb0128c572513d352120bd651c4559516d4500b5b0a3d257c4b45aca
2022-07-20Use HashWriter where possibleMacroFake
2022-07-19If P2TR tweaked key is available, sign with itPieter Wuille
2022-06-27sign: Use sigdata taproot spenddata when signingAndrew Chow
The taproot spenddata stored in a sigdata is the combination of data existing previously (e.g. in a PSBT) and the data stored in a SigningProvider. In order to use the external data when signing, we need to be using the sigdata's spenddata.
2022-06-27taproot: Use pre-existing signatures if availableAndrew Chow
Actually use pre-existing signatures in CreateTaprootScriptSig if a signature is found for the given key and leaf hash.
2022-06-27Fill PSBT Taproot output data to/from SignatureDataAndrew Chow
2022-06-27Fetch key origins for Taproot keysAndrew Chow
2022-05-17refactor: use C++11 default initializersfanquake
2022-05-04refactor: Change * to & in MutableTransactionSignatureCreatorMarcoFalke
2022-04-04refactor: fix clang-tidy named args usagefanquake
2022-03-04Merge bitcoin/bitcoin#24043: Add (sorted)multi_a descriptor for k-of-n ↵Andrew Chow
multisig inside tr 4828d53eccd52a67631c64cef0ba7df90dff138d Add (sorted)multi_a descriptors to doc/descriptors.md (Pieter Wuille) b5f33ac1f82aea290b4653af36ac2ad1bf1cce7b Simplify wallet_taproot.py functional test (Pieter Wuille) eb0667ea96d52db9135514a5e95ab943f6abd8a6 Add tests for (sorted)multi_a derivation/signing (Pieter Wuille) c17c6aa08df81aa0086d80b50187c8cd60ecc222 Add signing support for (sorted)multi_a scripts (Pieter Wuille) 3eed6fca57d1fa7544f372e6e7de0a9ae1b5715a Add multi_a descriptor inference (Pieter Wuille) 79728c4a3d8a74f276daf1e72abbdecdab85a5d8 Add (sorted)multi_a descriptor and script derivation (Pieter Wuille) 25e95f9ff89a97b87ce218f28274c3c821b2d54d Merge/generalize IsValidMultisigKeyCount/GetMultisigKeyCount (Pieter Wuille) Pull request description: This adds a new `multi_a(k,key_1,key_2,...,key_n)` (and corresponding `sortedmulti_a`) descriptor for k-of-n policies inside `tr()`. Semantically it is very similar to the existing `multi()` descriptor, but with the following changes: * The corresponding script is `<key1> OP_CHECKSIG <key2> OP_CHECKSIGADD <key3> OP_CHECKSIGADD ... <key_n> OP_CHECKSIGADD <k> OP_NUMEQUAL`, rather than the traditional `OP_CHECKMULTISIG`-based script, making it usable inside the `tr()` descriptor. * The keys can optionally be specified in x-only notation. * Both the number of keys and the threshold can be as high as 999; this is the limit due to the consensus stacksize=1000 limit I expect that this functionality will later be replaced with a miniscript-based implementation, but I don't think it's necessary to wait for that. Limitations: * The wallet code will for not estimate witness size incorrectly for script path spends, which may result in a (dramatic) fee underpayment with large multi_a scripts. * The multi_a script construction is (slightly) suboptimal for n-of-n (where a `<key1> OP_CHECKSIGVERIFY ... <key_n-1> OP_CHECKSIGVERIFY <key_n> OP_CHECKSIG` would be better). Such a construction is not included here. ACKs for top commit: achow101: ACK 4828d53eccd52a67631c64cef0ba7df90dff138d gruve-p: ACK https://github.com/bitcoin/bitcoin/pull/24043/commits/4828d53eccd52a67631c64cef0ba7df90dff138d sanket1729: code review ACK 4828d53eccd52a67631c64cef0ba7df90dff138d darosior: Code review ACK 4828d53eccd52a67631c64cef0ba7df90dff138d Tree-SHA512: 5dcd434b79585f0ff830f7d501d27df5e346f5749f47a3109ec309ebf2cbbad0e1da541eec654026d911ab67fd7cf7793fab0f765628d68d81b96ef2a4d234ce
2022-01-19Optimize CHECKSIGADD Script ValidationJeremy Rubin
2022-01-12Add signing support for (sorted)multi_a scriptsPieter Wuille
2021-12-30scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: fa0074e2d82928016a43ca408717154a1c70a4db * 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2021-12-10moveonly: Move (Un)Serialize(To/From)Vector, (De)SerializeHDKeypaths to psbt ↵Andrew Chow
module SerializeToVector, UnserializeFromVector, DeserializeHDKeypaths, and SerializeHDKeypaths were in sign.h where PSBT was originally implemented. Since all of the PSBT serialization has moved to its own file, these functions should follow.
2021-11-29Replace MakeSpan helper with Span deduction guidePieter Wuille
2021-11-16doc: Pick better named args for MutableTransactionSignatureCreatorMarcoFalke
Argument names of "nInIn" are not helpful.
2021-11-12Make signing follow BIP340 exactly w.r.t. aux randomnessPieter Wuille
libsecp256k1's secp256k1_schnorrsig_sign only follows BIP340 exactly if an aux_rand32 argument is passed. When no randomness is used (as is the case in the current codebase here), there is no impact on security between not providing aux_rand32 at all, or providing an empty one. Yet, for repeatability/testability it is simpler to always use an all-zero one.
2021-09-30[MOVEONLY] consensus: move amount.h into consensusfanquake
Move amount.h to consensus/amount.h. Renames, adds missing and removes uneeded includes.
2021-08-23Consolidate XOnlyPubKey lookup hackAndrew Chow
The places where we need to lookup information for a XOnlyPubKey currently implement a hack which makes both serializations of the full pubkey in order to try the CKeyIDs for the lookup functions. Instead of duplicating this everywhere it is needed, we can consolidate the CKeyID generation into a function, and then have wrappers around GetPubKey, GetKey, and GetKeyOrigin which takes the XOnlyPubKey, retrieves all of the CKeyIDs (using the new GetKeyIDs() function in XOnlyPubKey), and tries their respective underlying lookup function.
2021-08-20Simplify SignTransaction precomputation loopPieter Wuille
2021-08-20Improve comments in taproot signing logicPieter Wuille
2021-08-09Merge bitcoin/bitcoin#22337: wallet: Use bilingual_str for errorsSamuel Dobson
92993aa5cf37995e65e68dfd6f129ecaf418e01c Change SignTransaction's input_errors to use bilingual_str (Andrew Chow) 171366e89b828a557f8262d9dc14ff7a03f813f7 Use bilingual_str for address fetching functions (Andrew Chow) 9571c69b51115454c6a699be9492024f7b46c2b4 Add bilingual_str::clear() (Andrew Chow) Pull request description: In a couple of places in the wallet, errors are `std::string`. In order for these errors to be translated, change them to use `bilingual_str`. ACKs for top commit: hebasto: re-ACK 92993aa5cf37995e65e68dfd6f129ecaf418e01c, only rebased since my [previous](https://github.com/bitcoin/bitcoin/pull/22337#pullrequestreview-694542729) review, verified with klementtan: Code review ACK 92993aa5cf37995e65e68dfd6f129ecaf418e01c meshcollider: Code review ACK 92993aa5cf37995e65e68dfd6f129ecaf418e01c Tree-SHA512: 5400e419dd87db8c49b67ed0964de2d44b58010a566ca246f2f0760ed9ef6a9b6f6df7a6adcb211b315b74c727bfe8c7d07eb5690b5922fa5828ceef4c83461f
2021-07-15Make IsSegWitOutput return true for taproot outputsPieter Wuille
2021-07-01Change SignTransaction's input_errors to use bilingual_strAndrew Chow
2021-06-12Add support for SIGHASH_DEFAULT in RPCs, and make it defaultPieter Wuille
For non-Taproot signatures, this is interpreted as SIGHASH_ALL.
2021-06-12Basic Taproot signing logic in script/sign.cppPieter Wuille
2021-06-12Construct and use PrecomputedTransactionData in SignTransactionPieter Wuille
2021-06-12Don't nuke witness data when signing failsPieter Wuille
generated by cgit v1.2.3 (git 2.26.2) at 2024-09-13 23:52:46 +0000