2010-07-14 08:54:31 -07:00
|
|
|
// Copyright (c) 2009-2010 Satoshi Nakamoto
|
2016-12-31 10:01:21 -08:00
|
|
|
// Copyright (c) 2009-2016 The Bitcoin Core developers
|
2017-06-06 00:21:34 -07:00
|
|
|
// Copyright (c) 2017 The Zcash developers
|
2014-10-26 01:33:52 -07:00
|
|
|
// Distributed under the MIT software license, see the accompanying
|
2012-05-18 07:02:28 -07:00
|
|
|
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
2013-04-12 22:13:08 -07:00
|
|
|
|
2011-05-15 00:11:04 -07:00
|
|
|
#ifndef BITCOIN_KEY_H
|
|
|
|
#define BITCOIN_KEY_H
|
2010-07-14 08:54:31 -07:00
|
|
|
|
2017-11-09 16:57:53 -08:00
|
|
|
#include <pubkey.h>
|
|
|
|
#include <serialize.h>
|
|
|
|
#include <support/allocators/secure.h>
|
|
|
|
#include <uint256.h>
|
2013-04-12 22:13:08 -07:00
|
|
|
|
|
|
|
#include <stdexcept>
|
|
|
|
#include <vector>
|
2011-06-26 07:11:56 -07:00
|
|
|
|
2014-11-19 01:53:46 -08:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
/**
|
|
|
|
* secure_allocator is defined in allocators.h
|
2017-06-06 00:21:34 -07:00
|
|
|
* CPrivKey is a serialized private key, with all parameters included
|
|
|
|
* (PRIVATE_KEY_SIZE bytes)
|
2014-10-26 01:33:52 -07:00
|
|
|
*/
|
2011-05-15 00:11:04 -07:00
|
|
|
typedef std::vector<unsigned char, secure_allocator<unsigned char> > CPrivKey;
|
2010-07-14 08:54:31 -07:00
|
|
|
|
2013-04-30 21:52:05 -07:00
|
|
|
/** An encapsulated private key. */
|
2014-09-19 10:21:46 -07:00
|
|
|
class CKey
|
|
|
|
{
|
2017-10-04 06:41:40 -07:00
|
|
|
public:
|
|
|
|
/**
|
|
|
|
* secp256k1:
|
|
|
|
*/
|
|
|
|
static const unsigned int PRIVATE_KEY_SIZE = 279;
|
|
|
|
static const unsigned int COMPRESSED_PRIVATE_KEY_SIZE = 214;
|
|
|
|
/**
|
|
|
|
* see www.keylength.com
|
|
|
|
* script supports up to 75 for single byte push
|
|
|
|
*/
|
|
|
|
static_assert(
|
|
|
|
PRIVATE_KEY_SIZE >= COMPRESSED_PRIVATE_KEY_SIZE,
|
|
|
|
"COMPRESSED_PRIVATE_KEY_SIZE is larger than PRIVATE_KEY_SIZE");
|
|
|
|
|
2013-04-30 21:52:05 -07:00
|
|
|
private:
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Whether this private key is valid. We check for correctness when modifying the key
|
|
|
|
//! data, so fValid should always correspond to the actual state.
|
2013-04-30 21:52:05 -07:00
|
|
|
bool fValid;
|
2011-11-20 17:46:28 -08:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Whether the public key corresponding to this private key is (to be) compressed.
|
2013-04-30 21:52:05 -07:00
|
|
|
bool fCompressed;
|
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! The actual byte data
|
2016-09-17 23:40:14 -07:00
|
|
|
std::vector<unsigned char, secure_allocator<unsigned char> > keydata;
|
2016-07-18 19:39:46 -07:00
|
|
|
|
2017-03-18 18:13:55 -07:00
|
|
|
//! Check whether the 32-byte array pointed to by vch is valid keydata.
|
2014-09-19 10:21:46 -07:00
|
|
|
bool static Check(const unsigned char* vch);
|
2011-11-20 17:46:28 -08:00
|
|
|
|
2014-09-19 10:21:46 -07:00
|
|
|
public:
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Construct an invalid private key.
|
2014-09-19 10:21:46 -07:00
|
|
|
CKey() : fValid(false), fCompressed(false)
|
|
|
|
{
|
2016-09-17 23:40:14 -07:00
|
|
|
// Important: vch must be 32 bytes in length to not break serialization
|
|
|
|
keydata.resize(32);
|
2013-04-30 21:52:05 -07:00
|
|
|
}
|
2011-11-20 17:46:28 -08:00
|
|
|
|
2014-09-19 10:21:46 -07:00
|
|
|
friend bool operator==(const CKey& a, const CKey& b)
|
|
|
|
{
|
2016-07-18 19:39:46 -07:00
|
|
|
return a.fCompressed == b.fCompressed &&
|
|
|
|
a.size() == b.size() &&
|
2016-09-17 23:40:14 -07:00
|
|
|
memcmp(a.keydata.data(), b.keydata.data(), a.size()) == 0;
|
2013-07-14 16:05:25 -07:00
|
|
|
}
|
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Initialize using begin and end iterators to byte data.
|
2014-09-19 10:21:46 -07:00
|
|
|
template <typename T>
|
|
|
|
void Set(const T pbegin, const T pend, bool fCompressedIn)
|
|
|
|
{
|
2016-09-17 23:40:14 -07:00
|
|
|
if (size_t(pend - pbegin) != keydata.size()) {
|
2013-04-30 21:52:05 -07:00
|
|
|
fValid = false;
|
2016-07-18 19:39:46 -07:00
|
|
|
} else if (Check(&pbegin[0])) {
|
2016-09-17 23:40:14 -07:00
|
|
|
memcpy(keydata.data(), (unsigned char*)&pbegin[0], keydata.size());
|
2013-04-30 21:52:05 -07:00
|
|
|
fValid = true;
|
|
|
|
fCompressed = fCompressedIn;
|
|
|
|
} else {
|
|
|
|
fValid = false;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Simple read-only vector-like interface.
|
2016-09-17 23:40:14 -07:00
|
|
|
unsigned int size() const { return (fValid ? keydata.size() : 0); }
|
|
|
|
const unsigned char* begin() const { return keydata.data(); }
|
|
|
|
const unsigned char* end() const { return keydata.data() + size(); }
|
2013-04-30 21:52:05 -07:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Check whether this private key is valid.
|
2013-04-30 21:52:05 -07:00
|
|
|
bool IsValid() const { return fValid; }
|
2010-07-14 08:54:31 -07:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Check whether the public key corresponding to this private key is (to be) compressed.
|
2013-04-30 21:52:05 -07:00
|
|
|
bool IsCompressed() const { return fCompressed; }
|
2011-06-25 05:57:32 -07:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Generate a new private key using a cryptographic PRNG.
|
2012-05-16 09:36:38 -07:00
|
|
|
void MakeNewKey(bool fCompressed);
|
2013-04-30 21:52:05 -07:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
/**
|
|
|
|
* Convert the private key to a CPrivKey (serialized OpenSSL private key data).
|
2016-07-18 19:39:46 -07:00
|
|
|
* This is expensive.
|
2014-10-26 01:33:52 -07:00
|
|
|
*/
|
2012-05-16 09:36:38 -07:00
|
|
|
CPrivKey GetPrivKey() const;
|
2013-04-30 21:52:05 -07:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
/**
|
|
|
|
* Compute the public key from a private key.
|
|
|
|
* This is expensive.
|
|
|
|
*/
|
2012-05-14 10:07:52 -07:00
|
|
|
CPubKey GetPubKey() const;
|
2011-06-25 05:57:32 -07:00
|
|
|
|
2014-11-06 06:54:50 -08:00
|
|
|
/**
|
|
|
|
* Create a DER-serialized signature.
|
2015-03-27 15:31:44 -07:00
|
|
|
* The test_case parameter tweaks the deterministic nonce.
|
2014-11-06 06:54:50 -08:00
|
|
|
*/
|
|
|
|
bool Sign(const uint256& hash, std::vector<unsigned char>& vchSig, uint32_t test_case = 0) const;
|
2010-07-14 08:54:31 -07:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
/**
|
|
|
|
* Create a compact signature (65 bytes), which allows reconstructing the used public key.
|
|
|
|
* The format is one header byte, followed by two times 32 bytes for the serialized r and s values.
|
|
|
|
* The header byte: 0x1B = first key with even y, 0x1C = first key with odd y,
|
|
|
|
* 0x1D = second key with even y, 0x1E = second key with odd y,
|
|
|
|
* add 0x04 for compressed keys.
|
|
|
|
*/
|
2014-09-19 10:21:46 -07:00
|
|
|
bool SignCompact(const uint256& hash, std::vector<unsigned char>& vchSig) const;
|
2013-07-14 16:05:25 -07:00
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Derive BIP32 child key.
|
2015-04-21 15:09:37 -07:00
|
|
|
bool Derive(CKey& keyChild, ChainCode &ccChild, unsigned int nChild, const ChainCode& cc) const;
|
2013-10-28 03:20:26 -07:00
|
|
|
|
2014-11-06 01:17:48 -08:00
|
|
|
/**
|
|
|
|
* Verify thoroughly whether a private key and a public key match.
|
|
|
|
* This is done using a different mechanism than just regenerating it.
|
|
|
|
*/
|
|
|
|
bool VerifyPubKey(const CPubKey& vchPubKey) const;
|
|
|
|
|
2014-10-26 01:33:52 -07:00
|
|
|
//! Load private key and check that public key matches.
|
2014-09-19 10:21:46 -07:00
|
|
|
bool Load(CPrivKey& privkey, CPubKey& vchPubKey, bool fSkipCheck);
|
2013-07-14 16:05:25 -07:00
|
|
|
};
|
|
|
|
|
|
|
|
struct CExtKey {
|
|
|
|
unsigned char nDepth;
|
|
|
|
unsigned char vchFingerprint[4];
|
|
|
|
unsigned int nChild;
|
2015-04-21 15:09:37 -07:00
|
|
|
ChainCode chaincode;
|
2013-07-14 16:05:25 -07:00
|
|
|
CKey key;
|
|
|
|
|
2014-09-19 10:21:46 -07:00
|
|
|
friend bool operator==(const CExtKey& a, const CExtKey& b)
|
|
|
|
{
|
2016-07-18 19:39:46 -07:00
|
|
|
return a.nDepth == b.nDepth &&
|
|
|
|
memcmp(&a.vchFingerprint[0], &b.vchFingerprint[0], sizeof(vchFingerprint)) == 0 &&
|
|
|
|
a.nChild == b.nChild &&
|
|
|
|
a.chaincode == b.chaincode &&
|
|
|
|
a.key == b.key;
|
2013-07-14 16:05:25 -07:00
|
|
|
}
|
|
|
|
|
2015-06-01 07:35:19 -07:00
|
|
|
void Encode(unsigned char code[BIP32_EXTKEY_SIZE]) const;
|
|
|
|
void Decode(const unsigned char code[BIP32_EXTKEY_SIZE]);
|
2014-09-19 10:21:46 -07:00
|
|
|
bool Derive(CExtKey& out, unsigned int nChild) const;
|
2013-07-14 16:05:25 -07:00
|
|
|
CExtPubKey Neuter() const;
|
2014-09-19 10:21:46 -07:00
|
|
|
void SetMaster(const unsigned char* seed, unsigned int nSeedLen);
|
2015-06-01 07:35:19 -07:00
|
|
|
template <typename Stream>
|
2016-10-28 16:29:17 -07:00
|
|
|
void Serialize(Stream& s) const
|
2015-06-01 07:35:19 -07:00
|
|
|
{
|
|
|
|
unsigned int len = BIP32_EXTKEY_SIZE;
|
|
|
|
::WriteCompactSize(s, len);
|
|
|
|
unsigned char code[BIP32_EXTKEY_SIZE];
|
|
|
|
Encode(code);
|
|
|
|
s.write((const char *)&code[0], len);
|
|
|
|
}
|
|
|
|
template <typename Stream>
|
2016-10-28 16:29:17 -07:00
|
|
|
void Unserialize(Stream& s)
|
2015-06-01 07:35:19 -07:00
|
|
|
{
|
|
|
|
unsigned int len = ::ReadCompactSize(s);
|
|
|
|
unsigned char code[BIP32_EXTKEY_SIZE];
|
2017-08-17 12:54:23 -07:00
|
|
|
if (len != BIP32_EXTKEY_SIZE)
|
|
|
|
throw std::runtime_error("Invalid extended key size\n");
|
2015-06-01 07:35:19 -07:00
|
|
|
s.read((char *)&code[0], len);
|
|
|
|
Decode(code);
|
|
|
|
}
|
2010-07-14 08:54:31 -07:00
|
|
|
};
|
2011-05-15 00:11:04 -07:00
|
|
|
|
Update key.cpp to use new libsecp256k1
libsecp256k1's API changed, so update key.cpp to use it.
Libsecp256k1 now has explicit context objects, which makes it completely thread-safe.
In turn, keep an explicit context object in key.cpp, which is explicitly initialized
destroyed. This is not really pretty now, but it's more efficient than the static
initialized object in key.cpp (which made for example bitcoin-tx slow, as for most of
its calls, libsecp256k1 wasn't actually needed).
This also brings in the new blinding support in libsecp256k1. By passing in a random
seed, temporary variables during the elliptic curve computations are altered, in such
a way that if an attacker does not know the blind, observing the internal operations
leaks less information about the keys used. This was implemented by Greg Maxwell.
2015-04-22 14:28:26 -07:00
|
|
|
/** Initialize the elliptic curve support. May not be called twice without calling ECC_Stop first. */
|
|
|
|
void ECC_Start(void);
|
|
|
|
|
|
|
|
/** Deinitialize the elliptic curve support. No-op if ECC_Start wasn't called first. */
|
|
|
|
void ECC_Stop(void);
|
|
|
|
|
|
|
|
/** Check that required EC support is available at runtime. */
|
2014-06-02 16:21:03 -07:00
|
|
|
bool ECC_InitSanityCheck(void);
|
|
|
|
|
2014-08-28 13:21:03 -07:00
|
|
|
#endif // BITCOIN_KEY_H
|