d0938d817f
This commit implements a new secure, scalable, hierarchical deterministic
wallet address manager package.
The following is an overview of features:
- BIP0032 hierarchical deterministic keys
- BIP0043/BIP0044 multi-account hierarchy
- Strong focus on security:
- Fully encrypted database including public information such as
addresses as well as private information such as private keys and
scripts needed to redeem pay-to-script-hash transactions
- Hardened against memory scraping through the use of actively clearing
private material from memory when locked
- Different crypto keys used for public, private, and script data
- Ability for different passphrases for public and private data
- Scrypt-based key derivation
- NaCl-based secretbox cryptography (XSalsa20 and Poly1305)
- Multi-tier scalable key design to allow instant password changes
regardless of the number of addresses stored
- Import WIF keys
- Import pay-to-script-hash scripts for things such as multi-signature
transactions
- Ability to export a watching-only version which does not contain any
private key material
- Programmatically detectable errors, including encapsulation of errors
from packages it relies on
- Address synchronization capabilities
This commit only provides the implementation package. It does not
include integration into to the existing wallet code base or conversion of
existing addresses. That functionality will be provided by future
commits.
112 lines
2.1 KiB
Go
112 lines
2.1 KiB
Go
package snacl
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
)
|
|
|
|
var (
|
|
password = []byte("sikrit")
|
|
message = []byte("this is a secret message of sorts")
|
|
key *SecretKey
|
|
params []byte
|
|
blob []byte
|
|
)
|
|
|
|
func TestNewSecretKey(t *testing.T) {
|
|
var err error
|
|
key, err = NewSecretKey(&password, DefaultN, DefaultR, DefaultP)
|
|
if err != nil {
|
|
t.Error(err)
|
|
return
|
|
}
|
|
}
|
|
|
|
func TestMarshalSecretKey(t *testing.T) {
|
|
params = key.Marshal()
|
|
}
|
|
|
|
func TestUnmarshalSecretKey(t *testing.T) {
|
|
var sk SecretKey
|
|
if err := sk.Unmarshal(params); err != nil {
|
|
t.Errorf("unexpected unmarshal error: %v", err)
|
|
return
|
|
}
|
|
|
|
if err := sk.DeriveKey(&password); err != nil {
|
|
t.Errorf("unexpected DeriveKey error: %v", err)
|
|
return
|
|
}
|
|
|
|
if !bytes.Equal(sk.Key[:], key.Key[:]) {
|
|
t.Errorf("keys not equal")
|
|
}
|
|
}
|
|
|
|
func TestUnmarshalSecretKeyInvalid(t *testing.T) {
|
|
var sk SecretKey
|
|
if err := sk.Unmarshal(params); err != nil {
|
|
t.Errorf("unexpected unmarshal error: %v", err)
|
|
return
|
|
}
|
|
|
|
p := []byte("wrong password")
|
|
if err := sk.DeriveKey(&p); err != ErrInvalidPassword {
|
|
t.Errorf("wrong password didn't fail")
|
|
return
|
|
}
|
|
}
|
|
|
|
func TestEncrypt(t *testing.T) {
|
|
var err error
|
|
|
|
blob, err = key.Encrypt(message)
|
|
if err != nil {
|
|
t.Error(err)
|
|
return
|
|
}
|
|
}
|
|
|
|
func TestDecrypt(t *testing.T) {
|
|
decryptedMessage, err := key.Decrypt(blob)
|
|
if err != nil {
|
|
t.Error(err)
|
|
return
|
|
}
|
|
|
|
if !bytes.Equal(decryptedMessage, message) {
|
|
t.Errorf("decryption failed")
|
|
return
|
|
}
|
|
}
|
|
|
|
func TestDecryptCorrupt(t *testing.T) {
|
|
blob[len(blob)-15] = blob[len(blob)-15] + 1
|
|
_, err := key.Decrypt(blob)
|
|
if err == nil {
|
|
t.Errorf("corrupt message decrypted")
|
|
return
|
|
}
|
|
}
|
|
|
|
func TestZero(t *testing.T) {
|
|
var zeroKey [32]byte
|
|
|
|
key.Zero()
|
|
if !bytes.Equal(key.Key[:], zeroKey[:]) {
|
|
t.Errorf("zero key failed")
|
|
}
|
|
}
|
|
|
|
func TestDeriveKey(t *testing.T) {
|
|
if err := key.DeriveKey(&password); err != nil {
|
|
t.Errorf("unexpected DeriveKey key failure: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestDeriveKeyInvalid(t *testing.T) {
|
|
bogusPass := []byte("bogus")
|
|
if err := key.DeriveKey(&bogusPass); err != ErrInvalidPassword {
|
|
t.Errorf("unexpected DeriveKey key failure: %v", err)
|
|
}
|
|
}
|