LBRYCommunity/bitcoinjs-lib
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

HDWallet: adhere to BIP32 for CKD

Browse source
This commit is contained in:
Daniel Cousens 2014-05-10 09:41:18 +10:00
parent 25514d6ac1
commit 3ed7d78e59
1 changed files with 50 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

82
src/hdwallet.js
View file

@ -183,61 +183,79 @@ HDWallet.prototype.toBase58 = function(priv) {
])) ]))
} }
HDWallet.prototype.derive = function(i) { // https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#child-key-derivation-ckd-functions
var iBuffer = new Buffer(4) HDWallet.prototype.derive = function(index) {
iBuffer.writeUInt32BE(i, 0) var isHardened = index >= HDWallet.HIGHEST_BIT
var indexBuffer = new Buffer(4)
indexBuffer.writeUInt32BE(index, 0)
var cPar = this.chaincode var data
var usePriv = i >= HDWallet.HIGHEST_BIT
if (usePriv) { // Hardened child
assert(this.priv, 'Missing private key') if (isHardened) {
assert(this.priv, 'Could not derive hardened child key')
// If 1, private derivation is used: // data = 0x00 || ser256(kpar) || ser32(index)
// let I = HMAC-SHA512(Key = cpar, Data = 0x00 || kpar || i) [Note:] data = Buffer.concat([
var kPar = this.priv.toBuffer().slice(0, 32) this.priv.D.toBuffer(33),
iBuffer = Buffer.concat([new Buffer([0]), kPar, iBuffer], 37) indexBuffer
])
// Normal child
} else { } else {
// If 0, public derivation is used: // data = serP(point(kpar)) || ser32(index)
// let I = HMAC-SHA512(Key = cpar, Data = χ(kpar*G) || i) // = serP(Kpar) || ser32(index)
var KPar = this.pub.toBuffer() data = Buffer.concat([
iBuffer = Buffer.concat([KPar, iBuffer]) this.pub.toBuffer(),
indexBuffer
])
} }
var I = HmacSHA512(iBuffer, cPar) var I = HmacSHA512(data, this.chaincode)
var IL = I.slice(0, 32)
// Split I = IL || IR into two 32-byte sequences, IL and IR. var IR = I.slice(32)
var ILb = I.slice(0, 32)
, IRb = I.slice(32)
var hd = new HDWallet() var hd = new HDWallet()
hd.network = this.network var pIL = BigInteger.fromBuffer(IL)
var IL = BigInteger.fromBuffer(ILb)
// Private parent key -> private child key
if (this.priv) { if (this.priv) {
// ki = IL + kpar (mod n). // ki = parse256(IL) + kpar (mod n)
var ki = IL.add(this.priv.D).mod(ecparams.getN()) var ki = pIL.add(this.priv.D).mod(ecparams.getN())
// In case parse256(IL) >= n or ki == 0, one should proceed with the next value for i
if (pIL.compareTo(ecparams.getN()) >= 0 || ki.signum() === 0) {
return this.derive(index + 1)
}
hd.priv = new ECKey(ki, true) hd.priv = new ECKey(ki, true)
hd.pub = hd.priv.pub hd.pub = hd.priv.pub
// Public parent key -> public child key
} else { } else {
// Ki = (IL + kpar)*G = IL*G + Kpar // Ki = point(parse256(IL)) + Kpar
var Ki = ecparams.getG().multiply(IL).add(this.pub.Q) // = G*IL + Kpar
var Ki = ecparams.getG().multiply(pIL).add(this.pub.Q)
// In case parse256(IL) >= n or Ki is the point at infinity, one should proceed with the next value for i
if (pIL.compareTo(ecparams.getN()) >= 0 || Ki.isInfinity()) {
return this.derive(index + 1)
}
hd.pub = new ECPubKey(Ki, true) hd.pub = new ECPubKey(Ki, true)
} }
// ci = IR. hd.chaincode = IR
hd.chaincode = IRb
hd.parentFingerprint = this.getFingerprint().readUInt32BE(0)
hd.depth = this.depth + 1 hd.depth = this.depth + 1
hd.index = i hd.network = this.network
hd.pub.compressed = true hd.parentFingerprint = this.getFingerprint().readUInt32BE(0)
hd.index = index
return hd return hd
} }
HDWallet.prototype.derivePrivate = function(index) { HDWallet.prototype.derivePrivate = function(index) {
// Only derives hardened private keys by default
return this.derive(index + HDWallet.HIGHEST_BIT) return this.derive(index + HDWallet.HIGHEST_BIT)
} }