bitcoinrb 1.14.0 → 1.16.0

data/lib/bitcoin/script/script.rb

@@ -92,15 +92,26 @@ module Bitcoin
       new << WITNESS_VERSION_V0 << redeem_script.to_sha256
     end
 
+    # The range of a decimal number in a script string, as ParseScript in Bitcoin Core: a number
+    # outside of it is not valid in a script.
+    MAX_SCRIPT_STRING_NUMBER = 0xffffffff
+
     # generate script from string.
+    # A number is pushed as a script number, as ParseScript in Bitcoin Core does: 0, -1 and 1 to 16
+    # become OP_0, OP_1NEGATE and OP_1 to OP_16, and any other number a push of its minimal encoding.
+    # @param [String] string script string such as the result of #to_s.
+    # @return [Bitcoin::Script]
+    # @raise [ArgumentError] If a number is out of -0xffffffff..0xffffffff or a token is not valid.
     def self.from_string(string)
       script = new
       string.split(' ').each do |v|
         opcode = Opcodes.name_to_opcode(v)
         if opcode
           script << (v =~ /^\d/ && Opcodes.small_int_to_opcode(v.ord) ? v.ord : opcode)
+        elsif number_token?(v)
+          script.send(:push_script_number, v.to_i)
         else
-          script << (number_token?(v) ? v.to_i : v)
+          script << v
         end
       end
       script
@@ -112,7 +123,8 @@ module Bitcoin
     # @param [String] token a token of the script string.
     # @return [Boolean] whether +token+ should be interpreted as a script number.
     def self.number_token?(token)
-      return false unless token =~ /^[0-9]+$/
+      return true if token =~ /\A-[0-9]+\z/ # A negative number cannot be pushed data.
+      return false unless token =~ /\A[0-9]+\z/
       token.length < 12 || token.length.odd?
     end
 
@@ -153,31 +165,31 @@ module Bitcoin
             s.chunks << opcode
             return s
           end
-          len = case pushcode
-                  when OP_PUSHDATA1
-                    packed_size = buf.read(1)
-                    packed_size.unpack1('C')
-                  when OP_PUSHDATA2
-                    packed_size = buf.read(2)
-                    packed_size.unpack1('v')
-                  when OP_PUSHDATA4
-                    packed_size = buf.read(4)
-                    packed_size.unpack1('V')
-                  else
-                    pushcode < OP_PUSHDATA1 ? pushcode : 0
-                end
-          if buf.eof?
-            s.chunks << [len].pack('C')
+          size_length, format = case pushcode
+                                  when OP_PUSHDATA1 then [1, 'C']
+                                  when OP_PUSHDATA2 then [2, 'v']
+                                  when OP_PUSHDATA4 then [4, 'V']
+                                  else [0, nil]
+                                end
+          if size_length > 0
+            packed_size = buf.read(size_length)
+            # A length field cut short. Keep the bytes as they are so that the payload round trips,
+            # and leave it to the interpreter to reject the push.
+            if packed_size.bytesize < size_length
+              s.chunks << (opcode + packed_size)
+              return s
+            end
+            len = packed_size.unpack1(format)
           else
-            chunk = (packed_size ? (opcode + packed_size) : (opcode)) + buf.read(len)
-            s.chunks << chunk
+            len = pushcode
           end
+          # StringIO#read returns nil at EOF for a positive length, which is a push whose data is missing entirely.
+          s.chunks << (opcode + (packed_size || '') + buf.read(len).to_s)
         else
-          if Opcodes.defined?(opcode.ord)
-            s << opcode.ord
-          else
-            s.chunks << (opcode + buf.read) # If opcode is invalid, put all remaining data in last chunk.
-          end
+          # Every non-push byte is an opcode of its own, defined or not, like GetOp in Bitcoin Core.
+          # An undefined opcode only fails the script when it is executed, so the bytes after it
+          # still have to be parsed for OP_ELSE and OP_ENDIF in an unexecuted branch to be found.
+          s.chunks << opcode
         end
       end
       s
@@ -215,8 +227,23 @@ module Bitcoin
     end
 
     # check whether standard script.
+    # Whether this script is a standard scriptPubKey, as IsStandard in Bitcoin Core judges it.
+    # An OP_RETURN script is standard up to MAX_OP_RETURN_RELAY bytes, which a tx shares among all of its
+    # OP_RETURN outputs. A bare multisig has at most 3 public keys.
+    # @return [Boolean]
     def standard?
-      p2pkh? | p2sh? | p2wpkh? | p2wsh? | p2tr? | multisig? | standard_op_return? || p2a?
+      p2pkh? || p2sh? || p2wpkh? || p2wsh? || p2tr? || p2a? || witness_unknown? ||
+        standard_p2pk? || standard_multisig? || standard_op_return?
+    end
+
+    # Whether this script is a witness program of a version which is not defined yet, which Bitcoin Core relays
+    # so that a future soft fork can use it. A version 0 program is defined only for 20 and 32 bytes.
+    # @return [Boolean]
+    def witness_unknown?
+      return false unless witness_program?
+      version, program = witness_data
+      return false if version == 0
+      !(version == 1 && (program.bytesize == 32 || program == P2A_PROGRAM))
     end
 
     # Check whether this script is a P2PKH format script.
@@ -287,13 +314,46 @@ module Bitcoin
       sig_count <= pubkey_count
     end
 
+    # Whether a public key is of a valid size for its header byte, as CPubKey::ValidSize in Bitcoin Core checks it.
+    def self.valid_pubkey_size?(data)
+      return false if data.nil? || data.empty?
+      case data.getbyte(0)
+      when 0x02, 0x03 then data.bytesize == 33
+      when 0x04, 0x06, 0x07 then data.bytesize == 65
+      else false
+      end
+    end
+    private_class_method :valid_pubkey_size?
+
+    # Whether this script is a P2PK script which is standard.
+    # @return [Boolean]
+    def standard_p2pk?
+      chunks.size == 2 && chunks[0].pushdata? && chunks[1].ord == OP_CHECKSIG &&
+        Bitcoin::Script.send(:valid_pubkey_size?, chunks[0].pushed_data)
+    end
+
+    # Whether this script is a bare multisig script which is standard, m-of-n with 1 <= m <= n <= 3.
+    # @return [Boolean]
+    def standard_multisig?
+      return false if chunks.size < 4 || chunks.last.ord != OP_CHECKMULTISIG
+      m = chunks[0].opcode
+      n = chunks[-2].opcode
+      return false unless m && n && (OP_1..OP_16).cover?(m) && (OP_1..OP_16).cover?(n)
+      m = Opcodes.opcode_to_small_int(m)
+      n = Opcodes.opcode_to_small_int(n)
+      keys = chunks[1...-2]
+      return false unless keys.size == n && keys.all? { |k| k.pushdata? && Bitcoin::Script.send(:valid_pubkey_size?, k.pushed_data) }
+      n <= 3 && m <= n
+    end
+
     def op_return?
       chunks.size >= 1 && chunks[0].ord == OP_RETURN
     end
 
+    # Whether this script is an OP_RETURN script which is standard, OP_RETURN followed by pushes only.
+    # @return [Boolean]
     def standard_op_return?
-      op_return? && size <= MAX_OP_RETURN_RELAY &&
-          (chunks.size == 1 || chunks[1].opcode <= OP_16)
+      op_return? && size <= MAX_OP_RETURN_RELAY && chunks[1..-1].all? { |c| c.opcode.nil? || c.opcode <= OP_16 }
     end
 
     def op_return_data
@@ -334,11 +394,14 @@ module Bitcoin
     end
 
     # get witness commitment
+    # The witness commitment this script carries, if it is a commitment output as Bitcoin Core's
+    # GetWitnessCommitmentIndex recognizes it: at least 38 bytes which begin with OP_RETURN, a push of
+    # 0x24 bytes and the header aa21a9ed. Anything after the 32 byte commitment is ignored.
+    # @return [String, nil] The commitment with hex format, or nil if this is not a commitment output.
     def witness_commitment
-      return nil if !op_return? || op_return_data.bytesize < 36
-      buf = StringIO.new(op_return_data)
-      return nil unless buf.read(4).bth == WITNESS_COMMITMENT_HEADER
-      buf.read(32).bth
+      payload = to_payload
+      return nil if payload.bytesize < 38 || payload[0, 6] != "\x6a\x24".b + WITNESS_COMMITMENT_HEADER.htb
+      payload[6, 32].bth
     end
 
     # If this script is witness program, return its script code,
@@ -372,6 +435,24 @@ module Bitcoin
       end
     end
 
+    # Push +n+ as a script number. Unlike #push_int, a number which is also an opcode, e.g. 172
+    # (OP_CHECKSIG), is not appended as that opcode.
+    # @raise [ArgumentError] If +n+ is out of -0xffffffff..0xffffffff.
+    def push_script_number(n)
+      unless n.between?(-MAX_SCRIPT_STRING_NUMBER, MAX_SCRIPT_STRING_NUMBER)
+        raise ArgumentError, 'decimal numeric value only allowed in the range -0xFFFFFFFF...0xFFFFFFFF.'
+      end
+      if n == 0
+        chunks << Opcodes::OP_0.chr
+      elsif n == -1 || n.between?(1, 16)
+        chunks << Opcodes.small_int_to_opcode(n).chr
+      else
+        append_data(Script.encode_number(n))
+      end
+      self
+    end
+    private :push_script_number
+
     # push integer to stack.
     def push_int(n)
       begin
@@ -425,8 +506,8 @@ module Bitcoin
             if v
               v
             else
-              data = c.pushed_data
-              if data
+              if c.valid_pushdata_length?
+                data = c.pushed_data
                 if data.bytesize <= 4
                   Script.decode_number(data.bth) # for scriptnum
                 else

data/lib/bitcoin/script/script_interpreter.rb

@@ -67,7 +67,7 @@ module Bitcoin
         raise 'stack cannot be empty.' if stack.empty?
         redeem_script = Bitcoin::Script.parse_from_payload(stack.pop.htb)
         return false unless eval_script(redeem_script, :base)
-        return set_error(SCRIPT_ERR_EVAL_FALSE) if stack.empty? || !cast_to_bool(stack.last)
+        return set_error(SCRIPT_ERR_EVAL_FALSE) if stack.empty? || !cast_to_bool(stack.last.htb)
 
         # P2SH witness program
         if flag?(SCRIPT_VERIFY_WITNESS) && redeem_script.witness_program?
@@ -77,6 +77,8 @@ module Bitcoin
 
           version, program = redeem_script.witness_data
           return false unless verify_witness_program(witness, version, program, true)
+          # Bypass the cleanstack check at the end. The actual stack is obviously not clean for witness programs.
+          stack.resize!(1, Script.encode_number(0))
         end
       end
 
@@ -182,7 +184,7 @@ module Bitcoin
       return false unless eval_script(script_pubkey, sig_version, opts: opts)
 
       return set_error(SCRIPT_ERR_CLEANSTACK) unless stack.size == 1
-      return set_error(SCRIPT_ERR_EVAL_FALSE) unless cast_to_bool(stack.last)
+      return set_error(SCRIPT_ERR_EVAL_FALSE) unless cast_to_bool(stack.last.htb)
       true
     end
 
@@ -324,7 +326,7 @@ module Bitcoin
                   3.times { stack << stack[-3] }
                 when OP_IFDUP
                   return set_error(SCRIPT_ERR_INVALID_STACK_OPERATION) if stack.size < 1
-                  stack << stack.last if cast_to_bool(stack.last)
+                  stack << stack.last if cast_to_bool(stack.last.htb)
                 when OP_RIPEMD160
                   return set_error(SCRIPT_ERR_INVALID_STACK_OPERATION) if stack.size < 1
                   stack << Digest::RMD160.hexdigest(pop_string.htb)
@@ -483,6 +485,7 @@ module Bitcoin
 
                   push_int(success ? num + 1 : num)
                 when OP_CHECKMULTISIG, OP_CHECKMULTISIGVERIFY
+                  return set_error(SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG) if sig_version == :tapscript # BIP-342
                   return set_error(SCRIPT_ERR_INVALID_STACK_OPERATION)  if stack.size < 1
                   pubkey_count = pop_int
                   unless (0..MAX_PUBKEYS_PER_MULTISIG).include?(pubkey_count)
@@ -505,7 +508,8 @@ module Bitcoin
 
                   sigs = pop_string(sig_count)
                   sigs = [sigs] if sigs.is_a?(String)
-                  
+                  all_sigs = sigs.dup # the loop below drops a signature once it verifies
+
                   subscript = script.subscript(opts[:begincodehash]..-1)
 
                   if sig_version == :base
@@ -532,8 +536,9 @@ module Bitcoin
                   end
 
                   if !success && flag?(SCRIPT_VERIFY_NULLFAIL)
-                    sigs.each do |sig|
-                      # If the operation failed, we require that all signatures must be empty vector
+                    # If the operation failed, we require that all signatures must be empty vector, including
+                    # the ones which did verify, as Bitcoin Core checks every signature element on the stack.
+                    all_sigs.each do |sig|
                       return set_error(SCRIPT_ERR_SIG_NULLFAIL) if sig.bytesize > 0
                     end
                   end

data/lib/bitcoin/script/tx_checker.rb

@@ -63,11 +63,16 @@ module Bitcoin
 
       begin
         sighash = tx.sighash_for_input(input_index, opts: opts, hash_type: hash_type, sig_version: sig_version, prevouts: prevouts)
-        key = Key.from_xonly_pubkey(pubkey)
-        key.verify(sig, sighash, algo: :schnorr)
       rescue ArgumentError
         return set_error(SCRIPT_ERR_SCHNORR_SIG_HASHTYPE)
       end
+      begin
+        key = Key.from_xonly_pubkey(pubkey)
+      rescue ArgumentError
+        # A public key which is not on the curve makes the signature fail, as XOnlyPubKey::VerifySchnorr in Bitcoin Core does.
+        return set_error(SCRIPT_ERR_SCHNORR_SIG)
+      end
+      key.verify(sig, sighash, algo: :schnorr)
     end
 
     def check_locktime(locktime)

data/lib/bitcoin/script_witness.rb

@@ -14,11 +14,15 @@ module Bitcoin
       return self.new if buf.eof?
       size = Bitcoin.unpack_var_int_from_io(buf)
       stack = size.times.map do
-        buf.read(Bitcoin.unpack_var_int_from_io(buf))
+        Bitcoin.read_exact(buf, Bitcoin.unpack_var_int_from_io(buf))
       end
       self.new(stack)
     end
 
+    def ==(other)
+      other.is_a?(ScriptWitness) && stack == other.stack
+    end
+
     def empty?
       stack.empty?
     end

data/lib/bitcoin/secp256k1/ruby.rb

@@ -102,14 +102,20 @@ module Bitcoin
         digest = ECDSA.normalize_digest(data, group.bit_length)
         field = ECDSA::PrimeField.new(group.order)
 
-        unless rec & 2 == 0
-          r = field.mod(r + group.order)
+        # Bit 1 of the recovery id says the x coordinate of R is r + n rather than r. It only fits in the
+        # field when r < p - n, and libsecp256k1 rejects the signature otherwise. r + n must not be
+        # reduced modulo n here, which would turn it back into r.
+        x = r
+        if rec & 2 != 0
+          return nil if r >= group.field.prime - group.order
+          x = r + group.order
         end
 
         is_odd = (rec & 1 == 1)
-        y_coordinate = group.solve_for_y(r).find{|y| is_odd ? y.odd? : y.even?}
+        y_coordinate = group.solve_for_y(x).find{|y| is_odd ? y.odd? : y.even?}
+        return nil if y_coordinate.nil? # x is not on the curve
 
-        p = group.new_point([r, y_coordinate])
+        p = group.new_point([x, y_coordinate])
 
         inv_r = field.inverse(r)
         u1 = field.mod(inv_r * digest)

data/lib/bitcoin/silent_payment.rb

@@ -134,16 +134,19 @@ module Bitcoin
           end
         end
       elsif prevout.p2sh?
-        redeem_script = Bitcoin::Script.parse_from_payload(input.script_sig.chunks.last.pushed_data)
+        redeem_payload = input.script_sig.chunks.last&.pushed_data
+        return nil if redeem_payload.nil? # an input without a scriptSig, or whose last element is not a push
+        redeem_script = Bitcoin::Script.parse_from_payload(redeem_payload)
         if redeem_script.p2wpkh?
           pk = input.script_witness.stack.last
-          return Bitcoin::Key.new(pubkey: pk.bth) if pk.bytesize == Bitcoin::Key::COMPRESSED_PUBLIC_KEY_SIZE
+          return Bitcoin::Key.new(pubkey: pk.bth) if pk && pk.bytesize == Bitcoin::Key::COMPRESSED_PUBLIC_KEY_SIZE
         end
       elsif prevout.p2wpkh?
         pk = input.script_witness.stack.last
-        return Bitcoin::Key.new(pubkey: pk.bth) if pk.bytesize == Bitcoin::Key::COMPRESSED_PUBLIC_KEY_SIZE
+        return Bitcoin::Key.new(pubkey: pk.bth) if pk && pk.bytesize == Bitcoin::Key::COMPRESSED_PUBLIC_KEY_SIZE
       elsif prevout.p2tr?
         witness_stack = input.script_witness.stack.dup
+        return nil if witness_stack.empty?
         witness_stack.pop if witness_stack.last.bth.start_with?("50")
         if witness_stack.length > 1
           # script-path

data/lib/bitcoin/slip39/share.rb

@@ -5,7 +5,8 @@ module Bitcoin
     class Share
 
       attr_accessor :id               # 15 bits, Integer
-      attr_accessor :iteration_exp    # 5 bits, Integer
+      attr_accessor :extendable       # 1 bit, Boolean. The extendable backup flag.
+      attr_accessor :iteration_exp    # 4 bits, Integer
       attr_accessor :group_index      # 4 bits, Integer
       attr_accessor :group_threshold  # 4 bits, Integer
       attr_accessor :group_count      # 4 bits, Integer
@@ -14,6 +15,24 @@ module Bitcoin
       attr_accessor :value            # 8n bits, hex string.
       attr_accessor :checksum         # 30 bits, Integer
 
+      def initialize
+        @extendable = false
+      end
+
+      # Whether the extendable backup flag is set.
+      # When it is set, the identifier is not used as the salt of the master secret encryption, so sets of shares
+      # with different identifiers can be created for the same master secret and passphrase.
+      # @return [Boolean]
+      def extendable?
+        !!extendable
+      end
+
+      # The customization string of the RS1024 checksum for this share.
+      # @return [Array[Integer]]
+      def customization_string
+        extendable? ? CUSTOMIZATION_STRING_EXTENDABLE : CUSTOMIZATION_STRING_ORIG
+      end
+
       # Recover Share from the mnemonic words
       # @param [Array{String}] words the mnemonic words
       # @return [Bitcoin::SLIP39::Share] a share
@@ -26,15 +45,19 @@ module Bitcoin
         end
 
         raise ArgumentError, 'Invalid mnemonic length.' if indices.size < MIN_MNEMONIC_LENGTH_WORDS
-        raise ArgumentError, 'Invalid mnemonic checksum.' unless verify_rs1024_checksum(indices)
-
-        padding_length = (RADIX_BITS * (indices.size - METADATA_LENGTH_WORDS)) % 16
-        raise ArgumentError, 'Invalid mnemonic length.' if padding_length > 8
         data = indices.map{|i|i.to_s(2).rjust(10, '0')}.join
 
         s = self.new
         s.id = data[0...ID_LENGTH_BITS].to_i(2)
-        s.iteration_exp = data[ID_LENGTH_BITS...(ID_LENGTH_BITS + ITERATION_EXP_LENGTH_BITS)].to_i(2)
+        # The flag selects the customization string, so it is read before the checksum is verified.
+        s.extendable = data[ID_LENGTH_BITS] == '1'
+        raise ArgumentError, 'Invalid mnemonic checksum.' unless verify_rs1024_checksum(indices, s.customization_string)
+
+        padding_length = (RADIX_BITS * (indices.size - METADATA_LENGTH_WORDS)) % 16
+        raise ArgumentError, 'Invalid mnemonic length.' if padding_length > 8
+
+        exp_start = ID_LENGTH_BITS + EXTENDABLE_FLAG_LENGTH_BITS
+        s.iteration_exp = data[exp_start...(exp_start + ITERATION_EXP_LENGTH_BITS)].to_i(2)
         s.group_index = data[20...24].to_i(2)
         s.group_threshold = data[24...28].to_i(2) + 1
         s.group_count = data[28...32].to_i(2) + 1
@@ -46,7 +69,7 @@ module Bitcoin
         end_index = start_index + value_length - padding_length
         padding_value = data[40...(40 + padding_length)]
         raise ArgumentError, "Invalid mnemonic. padding must only zero." unless padding_value.to_i(2) == 0
-        s.value = data[start_index...end_index].to_i(2).to_even_length_hex
+        s.value = data[start_index...end_index].to_i(2).to_s(16).rjust((value_length - padding_length) / 4, '0')
         s.checksum = data[(40 + value_length)..-1].to_i(2)
         s
       end
@@ -84,7 +107,9 @@ module Bitcoin
       # @param [Boolean] include_checksum whether include checksum when creating indices.
       # @param [Array[Integer]] the array of index
       def build_word_indices(include_checksum = true)
+        raise ArgumentError, "Iteration exponent(#{iteration_exp}) must be between 0 and #{MAX_ITERATION_EXP}." unless (0..MAX_ITERATION_EXP).cover?(iteration_exp)
         s = id.to_bits(ID_LENGTH_BITS)
+        s << (extendable? ? '1' : '0')
         s << iteration_exp.to_bits(ITERATION_EXP_LENGTH_BITS)
         s << group_index.to_bits(4)
         s << (group_threshold - 1).to_bits(4)
@@ -92,8 +117,12 @@ module Bitcoin
         raise StandardError, "Group threshold(#{group_threshold}) cannot be greater than group count(#{group_count})." if group_threshold > group_count
         s << member_index.to_bits(4)
         s << (member_threshold - 1).to_bits(4)
-        value_length = value.to_i(16).bit_length
-        padding_length = RADIX_BITS - (value_length % RADIX_BITS)
+        # from_words derives the padding length from the number of value words modulo 16, which only
+        # matches the padding written here when the value is an even number of bytes. An odd one is
+        # read back as a different value instead of being rejected.
+        raise ArgumentError, 'The length of the share value in bytes must be an even number.' unless value.htb.bytesize.even?
+        value_length = value.htb.bytesize * 8
+        padding_length = (RADIX_BITS - (value_length % RADIX_BITS)) % RADIX_BITS
         s << value.to_i(16).to_bits(value_length + padding_length)
         s << checksum.to_bits(30) if include_checksum
         s.chars.each_slice(10).map{|index| index.join.to_i(2)}
@@ -101,16 +130,17 @@ module Bitcoin
 
       # Verify RS1024 checksum
       # @param [Array[Integer] data the array of mnemonic word index
+      # @param [Array[Integer]] cs the customization string
       # @return [Boolean] verify result
-      def self.verify_rs1024_checksum(data)
-        rs1024_polymod(CUSTOMIZATION_STRING + data) == 1
+      def self.verify_rs1024_checksum(data, cs)
+        rs1024_polymod(cs + data) == 1
       end
 
       # Create RS1024 checksum
       # @param [Array[Integer] data the array of mnemonic word index without checksum
       # @return [Array[Integer]] the array of checksum integer
       def create_rs1024_checksum(data)
-        values = CUSTOMIZATION_STRING + data + Array.new(CHECKSUM_LENGTH_WORDS, 0)
+        values = customization_string + data + Array.new(CHECKSUM_LENGTH_WORDS, 0)
         polymod = Bitcoin::SLIP39::Share.rs1024_polymod(values) ^ 1
         CHECKSUM_LENGTH_WORDS.times.to_a.reverse.map {|i|(polymod >> (10 * i)) & 1023 }
       end

data/lib/bitcoin/slip39/sss.rb

@@ -32,9 +32,15 @@ module Bitcoin
       # @param [Integer] exp Iteration exponent. default is 0.
       # @param [String] secret master secret with hex format.
       # @param [String] passphrase the passphrase used for encryption/decryption.
+      # @param [Boolean] extendable the extendable backup flag. default is true, as SLIP-39 recommends.
+      #   When it is set, the identifier is not used as the salt of the encryption, so another set of shares with
+      #   a different identifier can be created later for the same master secret and passphrase.
+      #   Shares with the flag set cannot be recovered by bitcoinrb 1.15.0 and earlier, nor by other implementations
+      #   which predate the flag.
       # @return [Array[Array[Bitcoin::SLIP39::Share]]] array of group shares.
-      def self.setup_shares(groups: [], group_threshold: nil, exp: 0, secret: nil, passphrase: '')
+      def self.setup_shares(groups: [], group_threshold: nil, exp: 0, secret: nil, passphrase: '', extendable: true)
         raise ArgumentError, 'Groups is empty.' if groups.empty?
+        raise ArgumentError, "Iteration exponent(#{exp}) must be between 0 and #{MAX_ITERATION_EXP}." unless (0..MAX_ITERATION_EXP).cover?(exp)
         raise ArgumentError, 'Group threshold must be greater than 0.' if group_threshold.nil? || group_threshold < 1
         raise ArgumentError, 'Master secret does not specified.' unless secret
         raise ArgumentError, "The length of the master secret (#{secret.htb.bytesize} bytes) must be at least #{MIN_STRENGTH_BITS / 8} bytes." if (secret.htb.bytesize * 8) < MIN_STRENGTH_BITS
@@ -48,7 +54,7 @@ module Bitcoin
         end
 
         id = SecureRandom.random_number(32767) # 32767 is max number for 15 bits.
-        ems = encrypt(secret, passphrase, exp, id)
+        ems = encrypt(secret, passphrase, exp, id, extendable)
 
         group_shares = split_secret(group_threshold, groups.length, ems)
 
@@ -59,6 +65,7 @@ module Bitcoin
           shares.map do |member_index, member_share|
             share = Bitcoin::SLIP39::Share.new
             share.id = id
+            share.extendable = extendable
             share.iteration_exp = exp
             share.group_index = group_index
             share.group_threshold = group_threshold
@@ -81,17 +88,22 @@ module Bitcoin
       #
       # @param [Array[Bitcoin::SLIP30::Share]] shares an array of shares.
       # @param [String] passphrase the passphrase using decrypt master secret.
+      # @param [Boolean] legacy_salt if true, build the PBKDF2 salt with the minimum number of bytes for the
+      #   identifier. Shares generated by bitcoinrb 1.14.0 and earlier need this to be recovered.
+      #   It has no effect on shares whose extendable backup flag is set, since their salt does not hold the identifier.
       # @return [String] a master secret.
-      def self.recover_secret(shares, passphrase: '')
+      def self.recover_secret(shares, passphrase: '', legacy_salt: false)
         raise ArgumentError, 'share is empty.' if shares.nil? || shares.empty?
         groups = {}
         id = shares[0].id
+        extendable = shares[0].extendable?
         exp = shares[0].iteration_exp
         group_threshold = shares.first.group_threshold
         group_count = shares.first.group_count
 
         shares.each do |share|
           raise ArgumentError, 'Invalid set of shares. All shares must have the same id.' unless id == share.id
+          raise ArgumentError, 'Invalid set of shares. All shares must have the same extendable backup flag.' unless extendable == share.extendable?
           raise ArgumentError, 'Invalid set of shares. All shares must have the same group threshold.' unless group_threshold == share.group_threshold
           raise ArgumentError, 'Invalid set of shares. All shares must have the same group count.' unless group_count == share.group_count
           raise ArgumentError, 'Invalid set of shares. All Shares must have the same iteration exponent.' unless exp == share.iteration_exp
@@ -127,7 +139,7 @@ module Bitcoin
           end
         end
 
-        return decrypt(group_shares.values.first, passphrase, exp, id) if group_threshold == 1
+        return decrypt(group_shares.values.first, passphrase, exp, id, extendable, legacy_salt) if group_threshold == 1
 
         raise ArgumentError, "Wrong number of mnemonics. Group threshold is #{group_threshold}, but share count is #{group_shares.length}" if group_shares.length < group_threshold
 
@@ -138,7 +150,7 @@ module Bitcoin
         recover_digest = create_digest(secret, random_value)
         raise ArgumentError, 'Invalid digest of the shared secret.' unless digest == recover_digest
 
-        decrypt(secret, passphrase, exp, id)
+        decrypt(secret, passphrase, exp, id, extendable, legacy_salt)
       end
 
       private
@@ -168,9 +180,11 @@ module Bitcoin
       # @param [String] passphrase the passphrase when using encrypt master secret with binary format.
       # @param [Integer] exp iteration exponent
       # @param [Integer] id identifier
-      def self.decrypt(ems, passphrase, exp, id)
+      # @param [Boolean] extendable the extendable backup flag
+      # @param [Boolean] legacy_salt if true, build the salt with the minimum number of bytes for the identifier.
+      def self.decrypt(ems, passphrase, exp, id, extendable, legacy_salt = false)
         l, r = ems[0...(ems.length / 2)].htb, ems[(ems.length / 2)..-1].htb
-        salt = get_salt(id)
+        salt = get_salt(id, extendable: extendable, legacy: legacy_salt)
         e = (Bitcoin::SLIP39::BASE_ITERATION_COUNT << exp) / Bitcoin::SLIP39::ROUND_COUNT
         Bitcoin::SLIP39::ROUND_COUNT.times.to_a.reverse.each do |i|
           f = OpenSSL::PKCS5.pbkdf2_hmac((i.itb + passphrase), salt + r, e, r.bytesize, 'sha256')
@@ -184,11 +198,12 @@ module Bitcoin
       # @param [String] passphrase the passphrase when using encrypt master secret with binary format.
       # @param [Integer] exp iteration exponent
       # @param [Integer] id identifier
+      # @param [Boolean] extendable the extendable backup flag
       # @return [String] encrypted master secret with hex format.
-      def self.encrypt(secret, passphrase, exp, id)
+      def self.encrypt(secret, passphrase, exp, id, extendable)
         s = secret.htb
         l, r = s[0...(s.bytesize / 2)], s[(s.bytesize / 2)..-1]
-        salt = get_salt(id)
+        salt = get_salt(id, extendable: extendable)
         e = (Bitcoin::SLIP39::BASE_ITERATION_COUNT << exp) / Bitcoin::SLIP39::ROUND_COUNT
         Bitcoin::SLIP39::ROUND_COUNT.times.to_a.each do |i|
           f = OpenSSL::PKCS5.pbkdf2_hmac((i.itb + passphrase), salt + r, e, r.bytesize, 'sha256')
@@ -206,11 +221,17 @@ module Bitcoin
         h[0...4].bth
       end
 
-      # get salt using encryption/decryption form id.
+      # get salt prefix used in encryption/decryption.
       # @param [Integer] id id
+      # @param [Boolean] extendable the extendable backup flag. If true, the salt is empty since the identifier
+      #   is not part of the encryption.
+      # @param [Boolean] legacy if true, encode the identifier with the minimum number of bytes. SLIP-39 requires
+      #   two bytes, so a salt built this way only matches shares generated by bitcoinrb 1.14.0 and earlier.
       # @return [String] salt with binary format.
-      def self.get_salt(id)
-        (Bitcoin::SLIP39::CUSTOMIZATION_STRING.pack('c*') + id.itb)
+      def self.get_salt(id, extendable: false, legacy: false)
+        return '' if extendable
+        identifier = legacy ? id.itb : [id].pack('n')
+        (Bitcoin::SLIP39::CUSTOMIZATION_STRING_ORIG.pack('c*') + identifier)
       end
 
       # Split the share into +count+ with threshold +threshold+.

data/lib/bitcoin/slip39.rb

@@ -19,18 +19,26 @@ module Bitcoin
     RADIX = 2 ** RADIX_BITS
     # The length of the random identifier in bits.
     ID_LENGTH_BITS = 15
+    # The length of the extendable backup flag in bits.
+    EXTENDABLE_FLAG_LENGTH_BITS = 1
     # The length of the iteration exponent in bits.
-    ITERATION_EXP_LENGTH_BITS = 5
-    # The length of the random identifier and iteration exponent in words.
-    ID_EXP_LENGTH_WORDS = bits_to_words(ID_LENGTH_BITS + ITERATION_EXP_LENGTH_BITS)
+    ITERATION_EXP_LENGTH_BITS = 4
+    # The maximum iteration exponent.
+    MAX_ITERATION_EXP = (1 << ITERATION_EXP_LENGTH_BITS) - 1
+    # The length of the random identifier, extendable backup flag and iteration exponent in words.
+    ID_EXP_LENGTH_WORDS = bits_to_words(ID_LENGTH_BITS + EXTENDABLE_FLAG_LENGTH_BITS + ITERATION_EXP_LENGTH_BITS)
     # The maximum number of shares that can be created.
     MAX_SHARE_COUNT = 16
     # The length of the RS1024 checksum in words.
     CHECKSUM_LENGTH_WORDS = 3
     # The length of the digest of the shared secret in bytes.
     DIGEST_LENGTH_BYTES = 4
-    # The customization string used in the RS1024 checksum and in the PBKDF2 salt.
-    CUSTOMIZATION_STRING = 'shamir'.bytes
+    # The customization string used in the RS1024 checksum and in the PBKDF2 salt when the extendable backup flag is not set.
+    CUSTOMIZATION_STRING_ORIG = 'shamir'.bytes
+    # The customization string used in the RS1024 checksum when the extendable backup flag is set.
+    CUSTOMIZATION_STRING_EXTENDABLE = 'shamir_extendable'.bytes
+    # Deprecated alias of CUSTOMIZATION_STRING_ORIG.
+    CUSTOMIZATION_STRING = CUSTOMIZATION_STRING_ORIG
     # The length of the mnemonic in words without the share value.
     METADATA_LENGTH_WORDS = ID_EXP_LENGTH_WORDS + 2 + CHECKSUM_LENGTH_WORDS
     # The minimum allowed entropy of the master secret.

data/lib/bitcoin/taproot/control_block.rb

@@ -41,7 +41,12 @@ module Bitcoin
       end
 
       def ==(other)
-        to_payload == other.to_payload
+        other.is_a?(ControlBlock) && to_payload == other.to_payload
+      end
+      alias eql? ==
+
+      def hash
+        to_payload.hash
       end
     end
   end