Merge pull request from dcousens/hdwallettests

HDWallet tests and strict constructor
This commit is contained in:
Wei Lu 2014-06-04 13:05:15 +08:00
commit 63e6cf987f
9 changed files with 705 additions and 534 deletions

285
src/hdnode.js Normal file
View file

@ -0,0 +1,285 @@
var assert = require('assert')
var base58 = require('./base58')
var BigInteger = require('bigi')
var crypto = require('./crypto')
var ECKey = require('./eckey')
var ECPubKey = require('./ecpubkey')
var ECPointFp = require('./ec').ECPointFp
var networks = require('./networks')
var sec = require('./sec')
var ecparams = sec("secp256k1")
function findBIP32ParamsByVersion(version) {
for (var name in networks) {
var network = networks[name]
for (var type in network.bip32) {
if (version != network.bip32[type]) continue
return {
isPrivate: (type === 'private'),
network: network
}
}
}
assert(false, 'Could not find version ' + version.toString(16))
}
function HDNode(K, chainCode, network) {
network = network || networks.bitcoin
assert(Buffer.isBuffer(chainCode), 'Expected Buffer, got ' + chainCode)
assert(network.bip32, 'Unknown BIP32 constants for network')
this.chainCode = chainCode
this.depth = 0
this.index = 0
this.network = network
if (K instanceof BigInteger) {
this.privKey = new ECKey(K, true)
this.pubKey = this.privKey.pub
} else {
this.pubKey = new ECPubKey(K, true)
}
}
HDNode.MASTER_SECRET = new Buffer('Bitcoin seed')
HDNode.HIGHEST_BIT = 0x80000000
HDNode.LENGTH = 78
HDNode.fromSeedBuffer = function(seed, network) {
var I = crypto.HmacSHA512(seed, HDNode.MASTER_SECRET)
var IL = I.slice(0, 32)
var IR = I.slice(32)
// In case IL is 0 or >= n, the master key is invalid
// This is handled by `new ECKey` in the HDNode constructor
var pIL = BigInteger.fromBuffer(IL)
return new HDNode(pIL, IR, network)
}
HDNode.fromSeedHex = function(hex, network) {
return HDNode.fromSeedBuffer(new Buffer(hex, 'hex'), network)
}
HDNode.fromBase58 = function(string) {
var buffer = base58.decode(string)
var payload = buffer.slice(0, -4)
var checksum = buffer.slice(-4)
var newChecksum = crypto.hash256(payload).slice(0, 4)
assert.deepEqual(newChecksum, checksum, 'Invalid checksum')
return HDNode.fromBuffer(payload)
}
HDNode.fromBuffer = function(buffer) {
assert.strictEqual(buffer.length, HDNode.LENGTH, 'Invalid buffer length')
// 4 byte: version bytes
var version = buffer.readUInt32BE(0)
var params = findBIP32ParamsByVersion(version)
// 1 byte: depth: 0x00 for master nodes, 0x01 for level-1 descendants, ...
var depth = buffer.readUInt8(4)
// 4 bytes: the fingerprint of the parent's key (0x00000000 if master key)
var parentFingerprint = buffer.readUInt32BE(5)
if (depth === 0) {
assert.strictEqual(parentFingerprint, 0x00000000, 'Invalid parent fingerprint')
}
// 4 bytes: child number. This is the number i in xi = xpar/i, with xi the key being serialized.
// This is encoded in MSB order. (0x00000000 if master key)
var index = buffer.readUInt32BE(9)
assert(depth > 0 || index === 0, 'Invalid index')
// 32 bytes: the chain code
var chainCode = buffer.slice(13, 45)
var hd
// 33 bytes: private key data (0x00 + k)
if (params.isPrivate) {
assert.strictEqual(buffer.readUInt8(45), 0x00, 'Invalid private key')
var data = buffer.slice(46, 78)
var D = BigInteger.fromBuffer(data)
hd = new HDNode(D, chainCode, params.network)
// 33 bytes: public key data (0x02 + X or 0x03 + X)
} else {
var data = buffer.slice(45, 78)
var decode = ECPointFp.decodeFrom(ecparams.getCurve(), data)
assert.equal(decode.compressed, true, 'Invalid public key')
// Verify that the X coordinate in the public point corresponds to a point on the curve.
// If not, the extended public key is invalid.
decode.Q.validate()
hd = new HDNode(decode.Q, chainCode, params.network)
}
hd.depth = depth
hd.index = index
hd.parentFingerprint = parentFingerprint
return hd
}
HDNode.fromHex = function(hex) {
return HDNode.fromBuffer(new Buffer(hex, 'hex'))
}
HDNode.prototype.getIdentifier = function() {
return crypto.hash160(this.pubKey.toBuffer())
}
HDNode.prototype.getFingerprint = function() {
return this.getIdentifier().slice(0, 4)
}
HDNode.prototype.getAddress = function() {
return this.pubKey.getAddress(this.network.pubKeyHash)
}
HDNode.prototype.toBase58 = function(isPrivate) {
var buffer = this.toBuffer(isPrivate)
var checksum = crypto.hash256(buffer).slice(0, 4)
return base58.encode(Buffer.concat([
buffer,
checksum
]))
}
HDNode.prototype.toBuffer = function(isPrivate) {
if (isPrivate == undefined) isPrivate = !!this.privKey
// Version
var version = isPrivate ? this.network.bip32.private : this.network.bip32.public
var buffer = new Buffer(HDNode.LENGTH)
// 4 bytes: version bytes
buffer.writeUInt32BE(version, 0)
// Depth
// 1 byte: depth: 0x00 for master nodes, 0x01 for level-1 descendants, ....
buffer.writeUInt8(this.depth, 4)
// 4 bytes: the fingerprint of the parent's key (0x00000000 if master key)
var fingerprint = (this.depth === 0) ? 0x00000000 : this.parentFingerprint
buffer.writeUInt32BE(fingerprint, 5)
// 4 bytes: child number. This is the number i in xi = xpar/i, with xi the key being serialized.
// This is encoded in Big endian. (0x00000000 if master key)
buffer.writeUInt32BE(this.index, 9)
// 32 bytes: the chain code
this.chainCode.copy(buffer, 13)
// 33 bytes: the public key or private key data
if (isPrivate) {
assert(this.privKey, 'Missing private key')
// 0x00 + k for private keys
buffer.writeUInt8(0, 45)
this.privKey.D.toBuffer(32).copy(buffer, 46)
} else {
// X9.62 encoding for public keys
this.pubKey.toBuffer().copy(buffer, 45)
}
return buffer
}
HDNode.prototype.toHex = function(isPrivate) {
return this.toBuffer(isPrivate).toString('hex')
}
// https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#child-key-derivation-ckd-functions
HDNode.prototype.derive = function(index) {
var isHardened = index >= HDNode.HIGHEST_BIT
var indexBuffer = new Buffer(4)
indexBuffer.writeUInt32BE(index, 0)
var data
// Hardened child
if (isHardened) {
assert(this.privKey, 'Could not derive hardened child key')
// data = 0x00 || ser256(kpar) || ser32(index)
data = Buffer.concat([
this.privKey.D.toBuffer(33),
indexBuffer
])
// Normal child
} else {
// data = serP(point(kpar)) || ser32(index)
// = serP(Kpar) || ser32(index)
data = Buffer.concat([
this.pubKey.toBuffer(),
indexBuffer
])
}
var I = crypto.HmacSHA512(data, this.chainCode)
var IL = I.slice(0, 32)
var IR = I.slice(32)
var pIL = BigInteger.fromBuffer(IL)
// In case parse256(IL) >= n, proceed with the next value for i
if (pIL.compareTo(ecparams.getN()) >= 0) {
return this.derive(index + 1)
}
// Private parent key -> private child key
var hd
if (this.privKey) {
// ki = parse256(IL) + kpar (mod n)
var ki = pIL.add(this.privKey.D).mod(ecparams.getN())
// In case ki == 0, proceed with the next value for i
if (ki.signum() === 0) {
return this.derive(index + 1)
}
hd = new HDNode(ki, IR, this.network)
// Public parent key -> public child key
} else {
// Ki = point(parse256(IL)) + Kpar
// = G*IL + Kpar
var Ki = ecparams.getG().multiply(pIL).add(this.pubKey.Q)
// In case Ki is the point at infinity, proceed with the next value for i
if (Ki.isInfinity()) {
return this.derive(index + 1)
}
hd = new HDNode(Ki, IR, this.network)
}
hd.depth = this.depth + 1
hd.index = index
hd.parentFingerprint = this.getFingerprint().readUInt32BE(0)
return hd
}
HDNode.prototype.deriveHardened = function(index) {
// Only derives hardened private keys by default
return this.derive(index + HDNode.HIGHEST_BIT)
}
HDNode.prototype.toString = HDNode.prototype.toBase58
module.exports = HDNode

View file

@ -1,260 +0,0 @@
var assert = require('assert')
var base58 = require('./base58')
var convert = require('./convert')
var Address = require('./address')
var BigInteger = require('bigi')
var crypto = require('./crypto')
var ECKey = require('./eckey')
var ECPubKey = require('./ecpubkey')
var networks = require('./networks')
var sec = require('./sec')
var ecparams = sec("secp256k1")
function HDWallet(seed, network) {
if (seed == undefined) return; // FIXME: Boo, should be stricter
network = network || networks.bitcoin
assert(network.bip32, 'Unknown BIP32 constants for network')
var I = crypto.HmacSHA512(seed, HDWallet.MASTER_SECRET)
var IL = I.slice(0, 32)
var IR = I.slice(32)
// In case IL is 0 or >= n, the master key is invalid (handled by ECKey.fromBuffer)
var pIL = BigInteger.fromBuffer(IL)
this.network = network
this.priv = new ECKey(pIL, true)
this.pub = this.priv.pub
this.chaincode = IR
this.depth = 0
this.index = 0
}
HDWallet.MASTER_SECRET = new Buffer('Bitcoin seed')
HDWallet.HIGHEST_BIT = 0x80000000
HDWallet.LENGTH = 78
HDWallet.fromSeedHex = function(hex, network) {
return new HDWallet(new Buffer(hex, 'hex'), network)
}
HDWallet.fromBase58 = function(string) {
var buffer = base58.decode(string)
var payload = buffer.slice(0, -4)
var checksum = buffer.slice(-4)
var newChecksum = crypto.hash256(payload).slice(0, 4)
assert.deepEqual(newChecksum, checksum, 'Invalid checksum')
assert.equal(payload.length, HDWallet.LENGTH, 'Invalid BIP32 string')
return HDWallet.fromBuffer(payload)
}
HDWallet.fromBuffer = function(input) {
assert.strictEqual(input.length, HDWallet.LENGTH, 'Invalid buffer length')
var hd = new HDWallet()
// 4 byte: version bytes
var version = input.readUInt32BE(0)
var type
for (var name in networks) {
var network = networks[name]
for (var t in network.bip32) {
if (version != network.bip32[t]) continue
type = t
hd.network = network
}
}
if (!hd.network) {
throw new Error('Could not find version ' + version.toString(16))
}
// 1 byte: depth: 0x00 for master nodes, 0x01 for level-1 descendants, ...
hd.depth = input.readUInt8(4)
// 4 bytes: the fingerprint of the parent's key (0x00000000 if master key)
hd.parentFingerprint = input.readUInt32BE(5)
if (hd.depth === 0) {
assert.strictEqual(hd.parentFingerprint, 0x00000000, 'Invalid parent fingerprint')
}
// 4 bytes: child number. This is the number i in xi = xpar/i, with xi the key being serialized.
// This is encoded in MSB order. (0x00000000 if master key)
hd.index = input.readUInt32BE(9)
assert(hd.depth > 0 || hd.index === 0, 'Invalid index')
// 32 bytes: the chain code
hd.chaincode = input.slice(13, 45)
// 33 bytes: the public key or private key data (0x02 + X or 0x03 + X for
// public keys, 0x00 + k for private keys)
if (type == 'priv') {
assert.equal(input.readUInt8(45), 0, 'Invalid private key')
var D = BigInteger.fromBuffer(input.slice(46, 78))
hd.priv = new ECKey(D, true)
hd.pub = hd.priv.pub
} else {
hd.pub = ECPubKey.fromBuffer(input.slice(45, 78), true)
}
return hd
}
HDWallet.prototype.getIdentifier = function() {
return crypto.hash160(this.pub.toBuffer())
}
HDWallet.prototype.getFingerprint = function() {
return this.getIdentifier().slice(0, 4)
}
HDWallet.prototype.getAddress = function() {
return this.pub.getAddress(this.getKeyVersion())
}
HDWallet.prototype.toBuffer = function(priv) {
// Version
var version = this.network.bip32[priv ? 'priv' : 'pub']
var buffer = new Buffer(HDWallet.LENGTH)
// 4 bytes: version bytes
buffer.writeUInt32BE(version, 0)
// Depth
// 1 byte: depth: 0x00 for master nodes, 0x01 for level-1 descendants, ....
buffer.writeUInt8(this.depth, 4)
// 4 bytes: the fingerprint of the parent's key (0x00000000 if master key)
var fingerprint = this.depth ? this.parentFingerprint : 0x00000000
buffer.writeUInt32BE(fingerprint, 5)
// 4 bytes: child number. This is the number i in xi = xpar/i, with xi the key being serialized.
// This is encoded in Big endian. (0x00000000 if master key)
buffer.writeUInt32BE(this.index, 9)
// 32 bytes: the chain code
this.chaincode.copy(buffer, 13)
// 33 bytes: the public key or private key data
if (priv) {
assert(this.priv, 'Missing private key')
// 0x00 + k for private keys
buffer.writeUInt8(0, 45)
this.priv.D.toBuffer(32).copy(buffer, 46)
} else {
// X9.62 encoding for public keys
this.pub.toBuffer().copy(buffer, 45)
}
return buffer
}
HDWallet.prototype.toHex = function(priv) {
return this.toBuffer(priv).toString('hex')
}
HDWallet.prototype.toBase58 = function(priv) {
var buffer = this.toBuffer(priv)
var checksum = crypto.hash256(buffer).slice(0, 4)
return base58.encode(Buffer.concat([
buffer,
checksum
]))
}
// https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#child-key-derivation-ckd-functions
HDWallet.prototype.derive = function(index) {
var isHardened = index >= HDWallet.HIGHEST_BIT
var indexBuffer = new Buffer(4)
indexBuffer.writeUInt32BE(index, 0)
var data
// Hardened child
if (isHardened) {
assert(this.priv, 'Could not derive hardened child key')
// data = 0x00 || ser256(kpar) || ser32(index)
data = Buffer.concat([
this.priv.D.toBuffer(33),
indexBuffer
])
// Normal child
} else {
// data = serP(point(kpar)) || ser32(index)
// = serP(Kpar) || ser32(index)
data = Buffer.concat([
this.pub.toBuffer(),
indexBuffer
])
}
var I = crypto.HmacSHA512(data, this.chaincode)
var IL = I.slice(0, 32)
var IR = I.slice(32)
var hd = new HDWallet()
var pIL = BigInteger.fromBuffer(IL)
// Private parent key -> private child key
if (this.priv) {
// ki = parse256(IL) + kpar (mod n)
var ki = pIL.add(this.priv.D).mod(ecparams.getN())
// In case parse256(IL) >= n or ki == 0, one should proceed with the next value for i
if (pIL.compareTo(ecparams.getN()) >= 0 || ki.signum() === 0) {
return this.derive(index + 1)
}
hd.priv = new ECKey(ki, true)
hd.pub = hd.priv.pub
// Public parent key -> public child key
} else {
// Ki = point(parse256(IL)) + Kpar
// = G*IL + Kpar
var Ki = ecparams.getG().multiply(pIL).add(this.pub.Q)
// In case parse256(IL) >= n or Ki is the point at infinity, one should proceed with the next value for i
if (pIL.compareTo(ecparams.getN()) >= 0 || Ki.isInfinity()) {
return this.derive(index + 1)
}
hd.pub = new ECPubKey(Ki, true)
}
hd.chaincode = IR
hd.depth = this.depth + 1
hd.network = this.network
hd.parentFingerprint = this.getFingerprint().readUInt32BE(0)
hd.index = index
return hd
}
HDWallet.prototype.derivePrivate = function(index) {
// Only derives hardened private keys by default
return this.derive(index + HDWallet.HIGHEST_BIT)
}
HDWallet.prototype.getKeyVersion = function() {
return this.network.pubKeyHash
}
HDWallet.prototype.toString = HDWallet.prototype.toBase58
module.exports = HDWallet

View file

@ -16,7 +16,7 @@ module.exports = {
ECPubKey: require('./ecpubkey'),
Message: require('./message'),
opcodes: require('./opcodes'),
HDWallet: require('./hdwallet'),
HDNode: require('./hdnode'),
Script: require('./script'),
sec: require('./sec'),
Transaction: T.Transaction,

View file

@ -4,8 +4,8 @@ module.exports = {
bitcoin: {
magicPrefix: '\x18Bitcoin Signed Message:\n',
bip32: {
pub: 0x0488b21e,
priv: 0x0488ade4
public: 0x0488b21e,
private: 0x0488ade4
},
pubKeyHash: 0x00,
scriptHash: 0x05,
@ -14,8 +14,8 @@ module.exports = {
dogecoin: {
magicPrefix: '\x19Dogecoin Signed Message:\n',
bip32: {
pub: 0x02facafd,
priv: 0x02fac398
public: 0x02facafd,
private: 0x02fac398
},
pubKeyHash: 0x1e,
scriptHash: 0x16,
@ -24,8 +24,8 @@ module.exports = {
litecoin: {
magicPrefix: '\x19Litecoin Signed Message:\n',
bip32: {
pub: 0x019da462,
priv: 0x019d9cfe
public: 0x019da462,
private: 0x019d9cfe
},
pubKeyHash: 0x30,
scriptHash: 0x05,
@ -34,8 +34,8 @@ module.exports = {
testnet: {
magicPrefix: '\x18Bitcoin Signed Message:\n',
bip32: {
pub: 0x043587cf,
priv: 0x04358394
public: 0x043587cf,
private: 0x04358394
},
pubKeyHash: 0x6f,
scriptHash: 0xc4,

View file

@ -3,7 +3,7 @@ var networks = require('./networks')
var rng = require('secure-random')
var Address = require('./address')
var HDNode = require('./hdwallet')
var HDNode = require('./hdnode')
var Transaction = require('./transaction').Transaction
function Wallet(seed, network) {
@ -29,11 +29,11 @@ function Wallet(seed, network) {
// Make a new master key
this.newMasterKey = function(seed) {
seed = seed || new Buffer(rng(32))
masterkey = new HDNode(seed, network)
masterkey = HDNode.fromSeedBuffer(seed, network)
// HD first-level child derivation method should be private
// HD first-level child derivation method should be hardened
// See https://bitcointalk.org/index.php?topic=405179.msg4415254#msg4415254
accountZero = masterkey.derivePrivate(0)
accountZero = masterkey.deriveHardened(0)
externalAccount = accountZero.derive(0)
internalAccount = accountZero.derive(1)
@ -246,11 +246,11 @@ function Wallet(seed, network) {
this.getExternalAccount = function() { return externalAccount }
this.getPrivateKey = function(index) {
return externalAccount.derive(index).priv
return externalAccount.derive(index).privKey
}
this.getInternalPrivateKey = function(index) {
return internalAccount.derive(index).priv
return internalAccount.derive(index).privKey
}
this.getPrivateKeyForAddress = function(address) {