bitcoinrb 1.12.1 → 1.14.0

data/lib/bitcoin/sighash_generator.rb

@@ -68,7 +68,7 @@ module Bitcoin
         hash_prevouts = Bitcoin.double_sha256(tx.inputs.map{|i|i.out_point.to_payload}.join)
         hash_sequence = Bitcoin.double_sha256(tx.inputs.map{|i|[i.sequence].pack('V')}.join)
         outpoint = tx.inputs[input_index].out_point.to_payload
-        amount = [amount].pack('Q')
+        amount = [amount].pack('Q<')
         nsequence = [tx.inputs[input_index].sequence].pack('V')
         hash_outputs = Bitcoin.double_sha256(tx.outputs.map{|o|o.to_payload}.join)
         if output_script.p2wsh?
@@ -107,8 +107,14 @@ module Bitcoin
       # - leaf_hash: leaf hash with binary format if sig_version is :tapscript, it required
       # - last_code_separator_pos: the position of last code separator
       # @return [String] signature hash with binary format.
+      # @raise [ArgumentError] If +opts[:prevouts]+ does not cover every input of the tx.
       def generate(tx, input_index, hash_type, opts)
         raise ArgumentError, 'Invalid sig_version was specified.' unless [:taproot, :tapscript].include?(opts[:sig_version])
+        # sha_amounts and sha_scriptpubkeys commit to every prevout, so a partial set silently
+        # produces a sighash which is not the one consensus computes for this tx.
+        unless opts[:prevouts].is_a?(Array) && opts[:prevouts].size == tx.in.size
+          raise ArgumentError, 'prevouts must be specified for all inputs.'
+        end
 
         ext_flag = opts[:sig_version] == :taproot ? 0 : 1
         key_version = 0
@@ -120,7 +126,7 @@ module Bitcoin
         buf << [hash_type, tx.version, tx.lock_time].pack('CVV')
         unless input_type == SIGHASH_TYPE[:anyonecanpay]
           buf << Bitcoin.sha256(tx.in.map{|i|i.out_point.to_payload}.join) # sha_prevouts
-          buf << Bitcoin.sha256(opts[:prevouts].map(&:value).pack('Q*'))# sha_amounts
+          buf << Bitcoin.sha256(opts[:prevouts].map(&:value).pack('Q<*'))# sha_amounts
           buf << Bitcoin.sha256(opts[:prevouts].map{|o|o.script_pubkey.to_payload(true)}.join) # sha_scriptpubkeys
           buf << Bitcoin.sha256(tx.in.map(&:sequence).pack('V*')) # sha_sequences
         end

data/lib/bitcoin/silent_payment.rb

@@ -1,5 +1,3 @@
-require 'set'
-
 module Bitcoin
   # BIP-352 silent payment module.
   # @see https://github.com/bitcoin/bips/blob/master/bip-0352.mediawiki
@@ -16,7 +14,7 @@ module Bitcoin
     # @param [Array<Bitcoin::Script>] prevouts An array of previous output script.
     # @param [Array<Bitcoin::Key>] private_keys An array of Bitcoin::Key objects corresponding to each public key in prevouts.
     # @param [Array<Bech32::SilentPaymentAddr>] recipients
-    # @return [Array<ECDSA::Point>] An array of derived points.
+    # @return [Array<ECDSA::Point>] An array of derived points, one per recipient in the same order.
     # @raise [ArgumentError]
     def derive_payment_points(prevouts, private_keys, recipients)
       raise ArgumentError, "prevouts must be Array." unless prevouts.is_a? Array
@@ -24,53 +22,41 @@ module Bitcoin
       raise ArgumentError, "prevouts and private_keys must be the same length." unless prevouts.length == private_keys.length
       raise ArgumentError, "recipients must be Array." unless recipients.is_a? Array
 
-      input_pub_keys = []
       field = ECDSA::PrimeField.new(Bitcoin::Secp256k1::GROUP.order)
+      plain_seckeys = []
+      taproot_seckeys = []
       sum_priv_keys = 0
       prevouts.each_with_index do |prevout, index|
         key = private_keys[index]
         raise ArgumentError, "private_keys element must be Bitcoin::Key." unless key.is_a? Bitcoin::Key
-        priv_key_int = key.priv_key.to_i(16)
         public_key = extract_public_key(prevout, inputs[index])
         next if public_key.nil?
-        private_key = if public_key.p2tr? && key.to_point.y.odd?
-                        field.mod(-priv_key_int)
-                      else
-                        priv_key_int
-                      end
-        input_pub_keys << public_key
-        sum_priv_keys = field.mod(sum_priv_keys + private_key)
+        priv_key_int = key.priv_key.to_i(16)
+        if public_key.p2tr?
+          taproot_seckeys << key.priv_key
+          priv_key_int = field.mod(-priv_key_int) unless key.to_point.has_even_y?
+        else
+          plain_seckeys << key.priv_key
+        end
+        sum_priv_keys = field.mod(sum_priv_keys + priv_key_int)
       end
-      agg_pubkey = (Bitcoin::Secp256k1::GROUP.generator.to_jacobian * sum_priv_keys).to_affine
-      return [] if agg_pubkey.infinity?
-
-      outpoint_l = inputs.map{|i|i.out_point.to_hex}.sort.first
-
-      input_hash = Bitcoin.tagged_hash("BIP0352/Inputs", outpoint_l.htb + agg_pubkey.to_hex.htb).bth
+      return [] if plain_seckeys.empty? && taproot_seckeys.empty?
+      # The input private keys sum to zero, so the aggregate public key is the point at infinity
+      # and no shared secret exists.
+      return [] if sum_priv_keys.zero?
 
-      destinations = {}
-      recipients.each do |sp_addr|
+      destinations = recipients.map do |sp_addr|
         raise ArgumentError, "recipients element must be Bech32::SilentPaymentAddr." unless sp_addr.is_a? Bech32::SilentPaymentAddr
-        destinations[sp_addr.scan_key] = [] unless destinations.has_key?(sp_addr.scan_key)
-        destinations[sp_addr.scan_key] << sp_addr.spend_key
+        [sp_addr.scan_key, sp_addr.spend_key]
       end
-
-      # Check K_max limit: fail if any group exceeds the limit
-      destinations.each_value do |spends|
-        raise ArgumentError, "Recipient group exceeds K_max limit (#{K_MAX})." if spends.length > K_MAX
+      destinations.group_by(&:first).each_value do |group|
+        raise ArgumentError, "Recipient group exceeds K_max limit (#{K_MAX})." if group.length > K_MAX
       end
 
-      outputs = []
-      destinations.each do |scan_key, spends|
-        scan_key = Bitcoin::Key.new(pubkey: scan_key).to_point.to_jacobian
-        ecdh_shared_secret = (scan_key * field.mod(input_hash.to_i(16) * sum_priv_keys)).to_affine.to_hex.htb
-        spends.each.with_index do |spend, i|
-          t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', ecdh_shared_secret + [i].pack('N'))
-          spend_key = Bitcoin::Key.new(pubkey: spend).to_point.to_jacobian
-          outputs << (spend_key + Bitcoin::Secp256k1::GROUP.generator.to_jacobian * t_k.bth.to_i(16)).to_affine
-        end
-      end
-      outputs
+      Bitcoin.secp_impl.sp_create_outputs(
+        destinations, sp_outpoint_smallest,
+        plain_seckeys: plain_seckeys, taproot_seckeys: taproot_seckeys
+      ).map { |xonly| Bitcoin::Key.from_xonly_pubkey(xonly).to_point }
     end
 
 
@@ -87,8 +73,11 @@ module Bitcoin
       raise ArgumentError, "scan_private_key must be Bitcoin::Key." unless scan_private_key.is_a? Bitcoin::Key
       raise ArgumentError, "spend_pubkey must be Bitcoin::Key." unless spend_pubkey.is_a? Bitcoin::Key
 
-      has_taproot = !outputs.find{|o| o.script_pubkey.p2tr? }.nil?
-      return [] unless has_taproot
+      taproot_outputs = outputs.select{|o| o.script_pubkey.p2tr? }
+      return [] if taproot_outputs.empty?
+
+      plain_pubkeys = []
+      xonly_pubkeys = []
       sum_pub_keys = Bitcoin::Secp256k1::GROUP.infinity.to_jacobian
       maximum_witness_version = Bitcoin::Opcodes.opcode_to_small_int(Bitcoin::Opcodes::OP_1)
       prevouts.each.with_index do |prevout, index|
@@ -96,64 +85,41 @@ module Bitcoin
 
         public_key = extract_public_key(prevout, inputs[index])
         next if public_key.nil?
+        if public_key.p2tr?
+          xonly_pubkeys << public_key.xonly_pubkey
+        else
+          plain_pubkeys << public_key.pubkey
+        end
         sum_pub_keys += public_key.to_point.to_jacobian
       end
+      return [] if plain_pubkeys.empty? && xonly_pubkeys.empty?
+      # Not a silent payment transaction, so there is nothing to find. Checked here rather than
+      # left to the implementation, which reports it as an error.
       return [] if sum_pub_keys.infinity?
 
-      field = ECDSA::PrimeField.new(Bitcoin::Secp256k1::GROUP.order)
-      outpoint_l = inputs.map{|i|i.out_point.to_hex}.sort.first
-      input_hash = Bitcoin.tagged_hash("BIP0352/Inputs", outpoint_l.htb + sum_pub_keys.to_affine.to_hex.htb).bth
-      ecdh_shared_secret = (sum_pub_keys * field.mod(input_hash.to_i(16) * scan_private_key.priv_key.to_i(16))).to_affine.to_hex.htb
-
-      # Pre-compute label tweak points with their label values and scalar tweaks
-      label_tweaks = labels.map do |m|
-        label_tweak = Bitcoin.tagged_hash('BIP0352/Label', scan_private_key.priv_key.htb + [m].pack('N'))
-        label_point = Bitcoin::Secp256k1::GROUP.generator.to_jacobian * label_tweak.bti
-        [m, label_tweak, label_point]
+      impl = Bitcoin.secp_impl
+      label_values = {}
+      label_tweaks = {}
+      labels.each do |m|
+        label, tweak = impl.sp_create_label(scan_private_key.priv_key, m)
+        label_values[label] = m
+        label_tweaks[label] = tweak
       end
 
-      k = 0
-      results = []
-      found_outputs = Set.new
-      loop do
-        # Stop scanning if K_max limit is reached
-        break if k == K_MAX
-
-        t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', ecdh_shared_secret + [k].pack('N'))
-        p_k = Bitcoin::Secp256k1::GROUP.generator.to_jacobian * t_k.bti + spend_pubkey.to_point.to_jacobian
-        found = false
-        outputs.each do |output|
-          next unless output.script_pubkey.p2tr?
-          next if found_outputs.include?(output)
-          output_pubkey = Bitcoin::Key.from_xonly_pubkey(output.script_pubkey.witness_data[1].bth)
-
-          # Check basic match (no label)
-          if p_k.to_affine.x == output_pubkey.to_point.x
-            results << SilentPayment::Output.new(output, t_k)
-            found_outputs << output
-            k += 1
-            found = true
-            break
-          end
-
-          # Check labeled matches
-          label_tweaks.each do |label_value, label_tweak_scalar, label_point|
-            p_k_labeled = p_k + label_point
-            if p_k_labeled.to_affine.x == output_pubkey.to_point.x
-              # Full tweak is t_k + label_tweak (mod order)
-              full_tweak = field.mod(t_k.bti + label_tweak_scalar.bti).to_s(16).rjust(64, '0').htb
-              results << SilentPayment::Output.new(output, full_tweak, label_value)
-              found_outputs << output
-              k += 1
-              found = true
-              break
-            end
-          end
-          break if found
-        end
-        break unless found
+      tx_outputs = taproot_outputs.map{|o| o.script_pubkey.witness_data[1].bth }
+      impl.sp_scan_outputs(tx_outputs, scan_private_key.priv_key, sp_outpoint_smallest, spend_pubkey.pubkey,
+                           plain_pubkeys: plain_pubkeys, xonly_pubkeys: xonly_pubkeys,
+                           labels: label_tweaks).map do |found|
+        tx_out = taproot_outputs[tx_outputs.index(found[:output])]
+        SilentPayment::Output.new(tx_out, found[:tweak].htb, found[:label] && label_values[found[:label]])
       end
-      results
+    end
+
+    # The lexicographically smallest outpoint of this tx's inputs, which the input hash of
+    # BIP-352 commits to.
+    # @return [String] The outpoint with hex format(36 bytes).
+    def sp_outpoint_smallest
+      inputs.map{|i| i.out_point.to_hex }.min
     end
 
     # Extract public keys from +prevout+ and input.

data/lib/bitcoin/taproot/control_block.rb

@@ -24,6 +24,7 @@ module Bitcoin
       # @return [Bitcoin::Taproot::ControlBlock]
       def self.parse_from_payload(payload)
         raise Bitcoin::Taproot::Error, 'Invalid data length for Control Block' if payload.bytesize > TAPROOT_CONTROL_MAX_SIZE
+        raise Bitcoin::Taproot::Error, 'Invalid data length for Control Block' if payload.bytesize < TAPROOT_CONTROL_BASE_SIZE
         raise Bitcoin::Taproot::Error, 'Invalid data length for path in Control Block' unless (payload.bytesize - TAPROOT_CONTROL_BASE_SIZE) % TAPROOT_CONTROL_NODE_SIZE == 0
         control, internal_key, paths = payload.unpack('Ca32a*')
         parity = control & 1

data/lib/bitcoin/taproot/custom_depth_builder.rb

@@ -35,14 +35,14 @@ module Bitcoin
 
       def merkle_root
         return '' if tree.empty?
-        script_tree = Merkle::CustomTree.new(config: Merkle::Config.taptree, leaves: extract_leaves(tree))
+        script_tree = Merkle::CustomTree.new(config: Merkle::Config.taptree(element_encoding: :hex), leaves: extract_leaves(tree))
         script_tree.compute_root
       end
 
       def extract_leaves(leaves)
         leaves.map do |leaf|
           if leaf.is_a?(Bitcoin::Taproot::LeafNode)
-            leaf.leaf_hash
+            leaf.leaf_hash.bth
           elsif leaf.is_a?(Array)
             extract_leaves(leaf)
           end

data/lib/bitcoin/taproot/simple_builder.rb

@@ -100,15 +100,17 @@ module Bitcoin
       private
 
       def script_tree
-        leaves = []
+        # A node holding one child hashes to that child, so the tree rejects the shape as
+        # indistinguishable from the child itself. A branch of one leaf, and a tree of one
+        # branch, are therefore that leaf and that branch rather than a node above them.
+        tree = nil
         branches.each do |pair|
-          if leaves.empty? || leaves.length == 1
-            leaves << pair.map(&:leaf_hash)
-          elsif leaves.length == 2
-            leaves = [leaves, pair.map(&:leaf_hash)]
-          end
+          hashes = pair.map { |leaf| leaf.leaf_hash.bth }
+          node = hashes.length == 1 ? hashes.first : hashes
+          tree = tree.nil? ? node : [tree, node]
         end
-        Merkle::CustomTree.new(config: Merkle::Config.taptree, leaves: leaves)
+        leaves = tree.is_a?(Array) ? tree : [tree]
+        Merkle::CustomTree.new(config: Merkle::Config.taptree(element_encoding: :hex), leaves: leaves)
       end
 
       def merkle_root

data/lib/bitcoin/taproot.rb

@@ -33,7 +33,12 @@ module Bitcoin
     def tweak_public_key(internal_key, merkle_root)
       t = tweak(internal_key, merkle_root)
       key = Bitcoin::Key.new(priv_key: t.bth, key_type: Key::TYPES[:compressed])
-      Bitcoin::Key.from_point(key.to_point + internal_key.to_point)
+      # BIP-341 tweaks lift_x(P), the point with even y. #tweak commits to the x-only key and
+      # #tweak_private_key negates the private key to match, so the point is lifted here too.
+      # An internal key with odd y would otherwise give a Q the tweaked private key cannot spend.
+      internal_point = internal_key.to_point
+      internal_point = internal_point.negate unless internal_point.has_even_y?
+      Bitcoin::Key.from_point(key.to_point + internal_point)
     end
 
     # Generate tweak private key

data/lib/bitcoin/tx.rb

@@ -89,6 +89,10 @@ module Bitcoin
       to_hex.to_i(16)
     end
 
+    def eql?(other)
+      other.is_a?(Tx) && self == other
+    end
+
     def tx_hash
       Bitcoin.double_sha256(serialize_old_format).bth
     end
@@ -228,7 +232,7 @@ module Bitcoin
     # @param [Integer] input_index
     # @param [Bitcoin::Script] script_pubkey the script pubkey for target input.
     # @param [Integer] amount the amount of bitcoin, require for witness program only.
-    # @param [Array] flags the flags used when execute script interpreter.
+    # @param [Integer] flags the flags used when execute script interpreter.
     # @param [Array[Bitcoin::TxOut]] prevouts Previous outputs referenced by all Tx inputs, required for taproot.
     # @return [Boolean] result
     def verify_input_sig(input_index, script_pubkey, amount: nil, flags: STANDARD_SCRIPT_VERIFY_FLAGS, prevouts: [])
@@ -236,11 +240,9 @@ module Bitcoin
       has_witness = inputs[input_index].has_witness?
       has_witness = true if script_pubkey.witness_program?
 
-      if script_pubkey.p2sh?
-        flags << SCRIPT_VERIFY_P2SH
-        redeem_script = Script.parse_from_payload(script_sig.chunks.last)
-        script_pubkey = redeem_script if redeem_script.p2wpkh?
-      end
+      # The script interpreter resolves the redeem script of P2SH, including a nested witness
+      # program, from the scriptSig, so the scriptPubkey is passed through as it is.
+      flags |= SCRIPT_VERIFY_P2SH if script_pubkey.p2sh?
 
       if has_witness
         verify_input_sig_for_witness(input_index, script_pubkey, amount, flags, prevouts)

data/lib/bitcoin/tx_out.rb

@@ -16,13 +16,13 @@ module Bitcoin
 
     def self.parse_from_payload(payload)
       buf = payload.is_a?(String) ? StringIO.new(payload) : payload
-      value = buf.read(8).unpack1('q')
+      value = buf.read(8).unpack1('Q<')
       script_size = Bitcoin.unpack_var_int_from_io(buf)
       new(value: value, script_pubkey: Script.parse_from_payload(buf.read(script_size)))
     end
 
     def to_payload
-      [value].pack('Q') << script_pubkey.to_payload(true)
+      [value].pack('Q<') << script_pubkey.to_payload(true)
     end
 
     def to_empty_payload

data/lib/bitcoin/util.rb

@@ -25,7 +25,7 @@ module Bitcoin
       elsif i <= 0xffffffff
         [0xfe, i].pack('CV')
       elsif i <= 0xffffffffffffffff
-        [0xff, i].pack('CQ')
+        [0xff, i].pack('CQ<')
       else
         raise "int(#{i}) too large!"
       end
@@ -39,7 +39,7 @@ module Bitcoin
       when 0xfe
         payload.unpack('xVa*')
       when 0xff
-        payload.unpack('xQa*')
+        payload.unpack('xQ<a*')
       else
         payload.unpack('Ca*')
       end
@@ -54,7 +54,7 @@ module Bitcoin
       when 0xfe
         buf.read(4)&.unpack1('V')
       when 0xff
-        buf.read(8)&.unpack1('Q')
+        buf.read(8)&.unpack1('Q<')
       else
         uchar
       end
@@ -152,7 +152,7 @@ module Bitcoin
       begin
         Bitcoin::Script.parse_from_addr(addr)
         true
-      rescue Exception
+      rescue StandardError
         false
       end
     end

data/lib/bitcoin/version.rb

@@ -1,3 +1,3 @@
 module Bitcoin
-  VERSION = "1.12.1"
+  VERSION = "1.14.0"
 end

data/lib/bitcoin/wallet/account.rb

@@ -33,7 +33,7 @@ module Bitcoin
         payload = buf.read
         name, payload = Bitcoin.unpack_var_string(payload)
         name = name.force_encoding('utf-8')
-        purpose, index, receive_depth, change_depth, lookahead = payload.unpack('I*')
+        purpose, index, receive_depth, change_depth, lookahead = payload.unpack('V*')
         a = Account.new(account_key, purpose, index, name)
         a.receive_depth = receive_depth
         a.change_depth = change_depth
@@ -44,7 +44,7 @@ module Bitcoin
       def to_payload
         payload = account_key.to_payload
         payload << Bitcoin.pack_var_string(name.unpack1('H*').htb)
-        payload << [purpose, index, receive_depth, change_depth, lookahead].pack('I*')
+        payload << [purpose, index, receive_depth, change_depth, lookahead].pack('V*')
         payload
       end
 

data/lib/bitcoin/wallet/db.rb

@@ -32,7 +32,7 @@ module Bitcoin
 
       def save_account(account)
         level_db.batch do
-          id = [account.purpose, account.index].pack('I*').bth
+          id = [account.purpose, account.index].pack('V*').bth
           key = KEY_PREFIX[:account] + id
           level_db.put(key, account.to_payload)
         end
@@ -40,14 +40,14 @@ module Bitcoin
 
       def save_key(account, purpose, index, key)
         pubkey = key.pub
-        id = [account.purpose, account.index, purpose, index].pack('I*').bth
+        id = [account.purpose, account.index, purpose, index].pack('V*').bth
         k = KEY_PREFIX[:key] + id
         level_db.put(k, pubkey)
         key
       end
 
       def get_keys(account)
-        id = [account.purpose, account.index].pack('I*').bth
+        id = [account.purpose, account.index].pack('V*').bth
         from = KEY_PREFIX[:key] + id + '00000000'
         to = KEY_PREFIX[:key] + id + 'ffffffff'
         level_db.each(from: from, to: to).map { |k, v| v}

data/lib/bitcoin/wallet/master_key.rb

@@ -8,15 +8,36 @@ module Bitcoin
       include Bitcoin::Util
       include Bitcoin::KeyPath
 
+      # The seed is not encrypted.
+      NOT_ENCRYPTED = 0
+      # AES-256-CBC with a key derived by PBKDF2-HMAC-SHA1. Only supported to load a wallet
+      # which was already encrypted, #encrypt always writes ENCRYPTED_V2.
+      ENCRYPTED_V1 = 1
+      # AES-256-GCM with a key derived by PBKDF2-HMAC-SHA512.
+      ENCRYPTED_V2 = 2
+
+      ENCRYPTION_VERSIONS = [ENCRYPTED_V1, ENCRYPTED_V2]
+
+      V1_KDF_ROUNDS = 2000
+      # Rounds for PBKDF2-HMAC-SHA512, which take roughly 100 ms.
+      KDF_ROUNDS = 210_000
+
+      SALT_SIZE = 16
+      GCM_IV_SIZE = 12
+      GCM_TAG_SIZE = 16
+
       attr_reader :seed
       attr_accessor :salt
       attr_accessor :encrypted
+      # The encryption version of +seed+, nil unless encrypted.
+      attr_reader :encryption_version
       attr_accessor :mnemonic # ephemeral data existing only at initialization
 
-      def initialize(seed, salt: '', encrypted: false, mnemonic: nil)
+      def initialize(seed, salt: '', encrypted: false, mnemonic: nil, encryption_version: nil)
         @mnemonic = mnemonic
         @seed = seed
         @encrypted = encrypted
+        @encryption_version = encrypted ? (encryption_version || ENCRYPTED_V2) : nil
         @salt = salt
       end
 
@@ -42,17 +63,18 @@ module Bitcoin
       # @return [Bitcoin::Wallet::MasterKey]
       def self.parse_from_payload(payload)
         flag, payload = unpack_var_int(payload)
-        raise 'encrypted flag is invalid.' unless [0, 1].include?(flag)
+        raise 'encrypted flag is invalid.' unless [NOT_ENCRYPTED, *ENCRYPTION_VERSIONS].include?(flag)
         salt, payload = unpack_var_string(payload)
         salt = '' unless salt
         seed, payload = unpack_var_string(payload)
-        self.new(seed.bth, salt: salt.bth, encrypted: flag == 1)
+        self.new(seed.bth, salt: salt.bth,
+                 encrypted: flag != NOT_ENCRYPTED, encryption_version: flag)
       end
 
       # generate payload with following format
-      # [encrypted(false:0, true:1)][salt(var str)][seed(var str)]
+      # [encryption version(not encrypted:0, v1:1, v2:2)][salt(var str)][seed(var str)]
       def to_payload
-        flg = encrypted ? 1 : 0
+        flg = encrypted ? encryption_version : NOT_ENCRYPTED
         pack_var_int(flg) << [salt, seed].map{|v|pack_var_string(v.htb)}.join
       end
 
@@ -71,39 +93,76 @@ module Bitcoin
         derived_key
       end
 
-      # encrypt seed
+      # Encrypt the seed with +passphrase+.
+      # The stored seed is [IV(12 bytes)][auth tag(16 bytes)][ciphertext].
+      # @param [String] passphrase
       def encrypt(passphrase)
         raise 'The wallet is already encrypted.' if encrypted
-        @salt = SecureRandom.hex(16)
-        enc = OpenSSL::Cipher.new('AES-256-CBC')
+        salt = SecureRandom.bytes(SALT_SIZE)
+        iv = SecureRandom.bytes(GCM_IV_SIZE)
+        enc = OpenSSL::Cipher.new('AES-256-GCM')
         enc.encrypt
-        enc.key, enc.iv = key_iv(enc, passphrase)
-        encrypted_data = ''
-        encrypted_data << enc.update(seed)
-        encrypted_data << enc.final
-        @seed = encrypted_data
+        enc.key = derive_key(passphrase, salt, enc.key_len)
+        enc.iv = iv
+        encrypted_data = enc.update(seed) << enc.final
+        @salt = salt.bth
+        @seed = (iv + enc.auth_tag(GCM_TAG_SIZE) + encrypted_data).bth
+        @encryption_version = ENCRYPTED_V2
         @encrypted = true
       end
 
-      # decrypt seed
+      # Decrypt the seed with +passphrase+.
+      # @param [String] passphrase
+      # @raise [ArgumentError] If +passphrase+ is wrong or the encrypted seed is corrupted.
       def decrypt(passphrase)
         raise 'The wallet is not encrypted.' unless encrypted
-        dec = OpenSSL::Cipher.new('AES-256-CBC')
-        dec.decrypt
-        dec.key, dec.iv = key_iv(dec, passphrase)
-        decrypted_data = ''
-        decrypted_data << dec.update(seed)
-        decrypted_data << dec.final
-        @seed = decrypted_data
+        @seed = encryption_version == ENCRYPTED_V1 ? decrypt_v1(passphrase) : decrypt_v2(passphrase)
         @encrypted = false
+        @encryption_version = nil
         @salt = ''
       end
 
       private
 
-      def key_iv(enc, passphrase)
-        key_iv = OpenSSL::PKCS5.pbkdf2_hmac_sha1(passphrase, salt, 2000, enc.key_len + enc.iv_len)
-        [key_iv[0, enc.key_len], key_iv[enc.key_len, enc.iv_len]]
+      # Derive an encryption key from +passphrase+.
+      # @param [String] passphrase
+      # @param [String] salt Salt with binary format.
+      # @param [Integer] length Key length in bytes.
+      # @return [String] Derived key with binary format.
+      def derive_key(passphrase, salt, length)
+        OpenSSL::PKCS5.pbkdf2_hmac(passphrase, salt, KDF_ROUNDS, length, OpenSSL::Digest::SHA512.new)
+      end
+
+      # Decrypt a seed stored by ENCRYPTED_V2.
+      # A wrong passphrase is rejected by the GCM authentication tag.
+      def decrypt_v2(passphrase)
+        data = seed.htb
+        raise ArgumentError, 'The encrypted seed is too short.' if data.bytesize <= GCM_IV_SIZE + GCM_TAG_SIZE
+        dec = OpenSSL::Cipher.new('AES-256-GCM')
+        dec.decrypt
+        dec.key = derive_key(passphrase, salt.htb, dec.key_len)
+        dec.iv = data[0...GCM_IV_SIZE]
+        dec.auth_tag = data[GCM_IV_SIZE...(GCM_IV_SIZE + GCM_TAG_SIZE)]
+        decrypt_with(dec, data[(GCM_IV_SIZE + GCM_TAG_SIZE)..-1])
+      end
+
+      # Decrypt a seed stored by ENCRYPTED_V1.
+      # That scheme has no authentication, so a wrong passphrase is only detected by the CBC
+      # padding and passes with a probability of about 1/256, yielding a garbage seed.
+      def decrypt_v1(passphrase)
+        dec = OpenSSL::Cipher.new('AES-256-CBC')
+        dec.decrypt
+        # The salt was passed to PBKDF2 as the hex string it is stored as, not as its bytes.
+        key_iv = OpenSSL::PKCS5.pbkdf2_hmac_sha1(passphrase, salt, V1_KDF_ROUNDS, dec.key_len + dec.iv_len)
+        dec.key = key_iv[0, dec.key_len]
+        dec.iv = key_iv[dec.key_len, dec.iv_len]
+        decrypt_with(dec, seed.htb)
+      end
+
+      def decrypt_with(dec, data)
+        dec.update(data) << dec.final
+      rescue OpenSSL::Cipher::CipherError
+        raise ArgumentError, 'Invalid passphrase.'
       end
 
     end

data/lib/bitcoin/wallet/utxo.rb

@@ -18,7 +18,7 @@ module Bitcoin
       def self.parse_from_payload(payload)
         return nil if payload.nil?
 
-        tx_hash, index, block_height, value, payload = payload.unpack('H64VVQa*')
+        tx_hash, index, block_height, value, payload = payload.unpack('H64VVQ<a*')
 
         buf = StringIO.new(payload)
         script_size = Bitcoin.unpack_var_int_from_io(buf)
@@ -27,7 +27,7 @@ module Bitcoin
       end
 
       def to_payload
-        payload = [tx_hash, index, block_height.nil? ? 0 : block_height, value].pack('H64VVQ')
+        payload = [tx_hash, index, block_height.nil? ? 0 : block_height, value].pack('H64VVQ<')
         s = script_pubkey.to_payload
         payload << Bitcoin.pack_var_int(s.length) << s
         payload

data/lib/bitcoin.rb

@@ -4,6 +4,7 @@
 require 'bitcoin/version'
 require 'schnorr'
 require 'securerandom'
+require 'stringio'
 require 'json'
 require 'bech32'
 require 'base64'