bitcoinrb 1.14.0 → 1.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 360a1a8533df9b68228d18279909e7bc5f45d4d5679caa1a02cda75e0a9140d0
-  data.tar.gz: ff86fcec32b3fe1394eea043080aaedafee61e724ec689cde5efdd7b9ca5c307
+  metadata.gz: 5da84e4a456d4b5a47fba7e5cfcfceabbfbdb9fe757f6080519130d2ebabc41c
+  data.tar.gz: 903301aa0eb0f349bc08c7133ebe80b9c731646fece6a407b75ace1bf6161aa8
 SHA512:
-  metadata.gz: 9aeb17cc9dc42ce33c4c31ed1f6424569d5c0f4f20627015c930d11e5ba2bf9c15f43cd20a666257caba689ffc0010b08b5855c13a3cf61a724c05fe8bcd383d
-  data.tar.gz: 14848d9c37a69ec5b0d2f993ce92c3cad3bdfc6275151789ff768ad5989d101f9c5545f1dc668d372f847b574fdc60d10e5f90b81b377b23ac20bfb3705b0a3a
+  metadata.gz: 39a539b3380c6dba3ac091a2b3706508e790d16d4367ff91f715c9804ac5803dc56893f5aaf4c3bc4dec71d4a1c03a2d4da481e0b060c291a913a96cc3a7f1db
+  data.tar.gz: dec61d2d90e67665aa4277de65b68a86c00779b820d5980e8d2facc85d0a0a4ba5c10989a43982fafc88463f40c02dfbfd3421b6f89f3e08620af4c008fa22fd

data/lib/bitcoin/key.rb

@@ -192,10 +192,17 @@ module Bitcoin
       Bitcoin::Script.to_p2wpkh(hash160).to_addr
     end
 
-    # Get pay to taproot address
+    # Get pay to taproot address.
+    # By default the x-only public key of this key becomes the output key as it is, which is
+    # what the rawtr() descriptor does. With +as_internal+ this key is the internal key P and
+    # the output key is Q = P + hash_TapTweak(P)G, which is what the tr() descriptor does and
+    # what BIP-86 defines for a single key address. Spending such an output needs the tweaked
+    # private key, see Bitcoin::Taproot.tweak_private_key.
+    # @param [Boolean] as_internal Whether to treat this key as the internal key. Default is false.
     # @return [String] address
-    def to_p2tr
-      Bitcoin::Script.to_p2tr(self).to_addr
+    def to_p2tr(as_internal: false)
+      output_key = as_internal ? Bitcoin::Taproot.tweak_public_key(self, '') : self
+      Bitcoin::Script.to_p2tr(output_key).to_addr
     end
 
     # get p2wpkh address nested in p2sh.

data/lib/bitcoin/message_sign.rb

@@ -33,6 +33,7 @@ module Bitcoin
     # @param [String] format Format of signature data. Default is +FORMAT_LEGACY+.
     # @param [String] prefix (Optional) Prefix used in legacy format.
     # @return [String] Signature, base64 encoded.
+    # @raise [ArgumentError] If +address+ is not supported, or +key+ does not correspond to it.
     def sign_message(key, message, prefix: Bitcoin.chain_params.message_magic, format: FORMAT_LEGACY, address: nil)
       validate_format!(format)
       digest = message_hash(message, prefix: prefix, legacy: format == FORMAT_LEGACY)
@@ -43,20 +44,15 @@ module Bitcoin
             else
               validate_address!(address)
               addr = Bitcoin::Script.parse_from_addr(address)
-              sig_ver, algo = if addr.p2wpkh? || addr.p2wsh?
-                                [:witness_v0, :ecdsa]
-                              elsif addr.p2tr?
-                                [:taproot, :schnorr]
-                              else
-
-                              end
               tx = to_sign_tx(digest, address)
               prev_out = Bitcoin::TxOut.new(script_pubkey: addr, value: 0)
               if addr.p2tr?
-                sighash = tx.sighash_for_input(0, addr, sig_version: :taproot, prevouts: [prev_out], hash_type: Bitcoin::SIGHASH_TYPE[:default])
                 tweaked = Bitcoin::Taproot.tweak_private_key(key, '')
+                validate_key!(Bitcoin::Script.to_p2tr(tweaked), addr, address)
+                sighash = tx.sighash_for_input(0, addr, sig_version: :taproot, prevouts: [prev_out], hash_type: Bitcoin::SIGHASH_TYPE[:default])
                 tx.in[0].script_witness.stack << tweaked.sign(sighash, algo: :schnorr)
-              elsif addr.p2wpkh? || addr.p2wsh?
+              elsif addr.p2wpkh?
+                validate_key!(Bitcoin::Script.to_p2wpkh(key.hash160), addr, address)
                 sighash = tx.sighash_for_input(0, addr, sig_version: :witness_v0, amount: 0, prevouts: [prev_out])
                 ecdsa  = key.sign(sighash, algo: :ecdsa) + [Bitcoin::SIGHASH_TYPE[:all]].pack('C')
                 tx.in[0].script_witness.stack << ecdsa
@@ -128,6 +124,23 @@ module Bitcoin
       Bitcoin::Script.parse_from_addr(address)
     end
 
+    # Ensure the signing key can satisfy +address+.
+    # A key the address does not commit to still produces a signature, and BIP-322 carries
+    # nothing that would report it verifies against no one.
+    # @param [Bitcoin::Script] derived The script the signing key produces.
+    # @param [Bitcoin::Script] expected The script of the address to be signed for.
+    # @param [String] address The address to be signed for, for the error message.
+    # @raise [ArgumentError] If the key does not correspond to +address+.
+    def validate_key!(derived, expected, address)
+      return if derived == expected
+      message = "Key does not correspond to #{address}."
+      if expected.p2tr?
+        message += ' A P2TR address holds the output key, which is the internal key this key' \
+                   ' holds tweaked with an empty merkle root. See Bitcoin::Key#to_p2tr.'
+      end
+      raise ArgumentError, message
+    end
+
     def validate_format!(format)
       unless [FORMAT_LEGACY, FORMAT_FULL, FORMAT_SIMPLE].include?(format)
         raise ArgumentError "Invalid format specified."
@@ -197,6 +210,7 @@ module Bitcoin
     end
 
     private_class_method :validate_address!
+    private_class_method :validate_key!
     private_class_method :validate_format!
     private_class_method :validate_to_sign_tx!
     private_class_method :run_interpreter

data/lib/bitcoin/slip39/share.rb

@@ -46,7 +46,7 @@ module Bitcoin
         end_index = start_index + value_length - padding_length
         padding_value = data[40...(40 + padding_length)]
         raise ArgumentError, "Invalid mnemonic. padding must only zero." unless padding_value.to_i(2) == 0
-        s.value = data[start_index...end_index].to_i(2).to_even_length_hex
+        s.value = data[start_index...end_index].to_i(2).to_s(16).rjust((value_length - padding_length) / 4, '0')
         s.checksum = data[(40 + value_length)..-1].to_i(2)
         s
       end
@@ -92,8 +92,12 @@ module Bitcoin
         raise StandardError, "Group threshold(#{group_threshold}) cannot be greater than group count(#{group_count})." if group_threshold > group_count
         s << member_index.to_bits(4)
         s << (member_threshold - 1).to_bits(4)
-        value_length = value.to_i(16).bit_length
-        padding_length = RADIX_BITS - (value_length % RADIX_BITS)
+        # from_words derives the padding length from the number of value words modulo 16, which only
+        # matches the padding written here when the value is an even number of bytes. An odd one is
+        # read back as a different value instead of being rejected.
+        raise ArgumentError, 'The length of the share value in bytes must be an even number.' unless value.htb.bytesize.even?
+        value_length = value.htb.bytesize * 8
+        padding_length = (RADIX_BITS - (value_length % RADIX_BITS)) % RADIX_BITS
         s << value.to_i(16).to_bits(value_length + padding_length)
         s << checksum.to_bits(30) if include_checksum
         s.chars.each_slice(10).map{|index| index.join.to_i(2)}

data/lib/bitcoin/slip39/sss.rb

@@ -81,8 +81,10 @@ module Bitcoin
       #
       # @param [Array[Bitcoin::SLIP30::Share]] shares an array of shares.
       # @param [String] passphrase the passphrase using decrypt master secret.
+      # @param [Boolean] legacy_salt if true, build the PBKDF2 salt with the minimum number of bytes for the
+      #   identifier. Shares generated by bitcoinrb 1.14.0 and earlier need this to be recovered.
       # @return [String] a master secret.
-      def self.recover_secret(shares, passphrase: '')
+      def self.recover_secret(shares, passphrase: '', legacy_salt: false)
         raise ArgumentError, 'share is empty.' if shares.nil? || shares.empty?
         groups = {}
         id = shares[0].id
@@ -127,7 +129,7 @@ module Bitcoin
           end
         end
 
-        return decrypt(group_shares.values.first, passphrase, exp, id) if group_threshold == 1
+        return decrypt(group_shares.values.first, passphrase, exp, id, legacy_salt) if group_threshold == 1
 
         raise ArgumentError, "Wrong number of mnemonics. Group threshold is #{group_threshold}, but share count is #{group_shares.length}" if group_shares.length < group_threshold
 
@@ -138,7 +140,7 @@ module Bitcoin
         recover_digest = create_digest(secret, random_value)
         raise ArgumentError, 'Invalid digest of the shared secret.' unless digest == recover_digest
 
-        decrypt(secret, passphrase, exp, id)
+        decrypt(secret, passphrase, exp, id, legacy_salt)
       end
 
       private
@@ -168,9 +170,10 @@ module Bitcoin
       # @param [String] passphrase the passphrase when using encrypt master secret with binary format.
       # @param [Integer] exp iteration exponent
       # @param [Integer] id identifier
-      def self.decrypt(ems, passphrase, exp, id)
+      # @param [Boolean] legacy_salt if true, build the salt with the minimum number of bytes for the identifier.
+      def self.decrypt(ems, passphrase, exp, id, legacy_salt = false)
         l, r = ems[0...(ems.length / 2)].htb, ems[(ems.length / 2)..-1].htb
-        salt = get_salt(id)
+        salt = get_salt(id, legacy_salt)
         e = (Bitcoin::SLIP39::BASE_ITERATION_COUNT << exp) / Bitcoin::SLIP39::ROUND_COUNT
         Bitcoin::SLIP39::ROUND_COUNT.times.to_a.reverse.each do |i|
           f = OpenSSL::PKCS5.pbkdf2_hmac((i.itb + passphrase), salt + r, e, r.bytesize, 'sha256')
@@ -208,9 +211,12 @@ module Bitcoin
 
       # get salt using encryption/decryption form id.
       # @param [Integer] id id
+      # @param [Boolean] legacy if true, encode the identifier with the minimum number of bytes. SLIP-39 requires
+      #   two bytes, so a salt built this way only matches shares generated by bitcoinrb 1.14.0 and earlier.
       # @return [String] salt with binary format.
-      def self.get_salt(id)
-        (Bitcoin::SLIP39::CUSTOMIZATION_STRING.pack('c*') + id.itb)
+      def self.get_salt(id, legacy = false)
+        identifier = legacy ? id.itb : [id].pack('n')
+        (Bitcoin::SLIP39::CUSTOMIZATION_STRING.pack('c*') + identifier)
       end
 
       # Split the share into +count+ with threshold +threshold+.

data/lib/bitcoin/version.rb

@@ -1,3 +1,3 @@
 module Bitcoin
-  VERSION = "1.14.0"
+  VERSION = "1.15.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bitcoinrb
 version: !ruby/object:Gem::Version
-  version: 1.14.0
+  version: 1.15.0
 platform: ruby
 authors:
 - azuchi