bitcoinrb 1.13.0 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc2fd227e7a25b6fa3bdd88ef6035e7b7f4a76bb1ef501285ccd0f7f5d961c4c
-  data.tar.gz: 0f2557375f3918a5416983dde696cb922be71cf7a7c762c2be2305b6e9edb3d3
+  metadata.gz: 360a1a8533df9b68228d18279909e7bc5f45d4d5679caa1a02cda75e0a9140d0
+  data.tar.gz: ff86fcec32b3fe1394eea043080aaedafee61e724ec689cde5efdd7b9ca5c307
 SHA512:
-  metadata.gz: 9cd9ed6bfca773abf5d25228be6b2a88ef7a17c163e3ddd5bb7de9c6365261d65e51fa8c3e9a6f87304a5bfc48036f87e7b0fb99d8b910c368001f7c5aa78d81
-  data.tar.gz: bec0d5c4ab556984e2fb9fa4da85008c92fb392d4510e41901701626658f8356f20aa5b74d1837ed90c1a35efe86b52f6ea5713b90f4c2caf2112b47a42a1706
+  metadata.gz: 9aeb17cc9dc42ce33c4c31ed1f6424569d5c0f4f20627015c930d11e5ba2bf9c15f43cd20a666257caba689ffc0010b08b5855c13a3cf61a724c05fe8bcd383d
+  data.tar.gz: 14848d9c37a69ec5b0d2f993ce92c3cad3bdfc6275151789ff768ad5989d101f9c5545f1dc668d372f847b574fdc60d10e5f90b81b377b23ac20bfb3705b0a3a

data/bitcoinrb.gemspec

@@ -27,8 +27,8 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'bip-schnorr', '>= 0.7.0'
   spec.add_runtime_dependency 'base32', '>= 0.3.4'
   spec.add_runtime_dependency 'base64', '~> 0.2.0'
-  spec.add_runtime_dependency 'secp256k1rb', '0.1.1'
+  spec.add_runtime_dependency 'secp256k1rb', '0.8.0'
   spec.add_runtime_dependency 'logger'
-  spec.add_runtime_dependency 'merkle', '0.3.0'
+  spec.add_runtime_dependency 'merkle', '1.0.0'
   spec.add_runtime_dependency 'dnsruby', '1.73.0'
 end

data/lib/bitcoin/base58.rb

@@ -8,6 +8,10 @@ module Bitcoin
     ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
     SIZE = ALPHABET.size
 
+    # Upper bound for #decode. Decoding is quadratic in the length of the input, and the
+    # longest value Bitcoin encodes with Base58 is an extended key, at 111 characters.
+    MAX_LENGTH = 256
+
     # encode hex value to base58 string.
     def encode(hex)
       leading_zero_bytes = (hex.match(/^([0]+)/) ? $1 : '').size / 2
@@ -21,11 +25,19 @@ module Bitcoin
     end
 
     # decode base58 string to hex value.
+    # @param [String] base58_val Base58 string.
+    # @return [String] Decoded value with hex format.
+    # @raise [ArgumentError] If +base58_val+ is longer than MAX_LENGTH or holds a character
+    # which is not in the alphabet.
     def decode(base58_val)
+      if base58_val.length > MAX_LENGTH
+        raise ArgumentError, "Base58 string must not be longer than #{MAX_LENGTH} characters."
+      end
       int_val = 0
-      base58_val.reverse.split(//).each_with_index do |char,index|
-        raise ArgumentError, 'Value passed not a valid Base58 String.' if (char_index = ALPHABET.index(char)).nil?
-        int_val += char_index * (SIZE ** index)
+      base58_val.each_char do |char|
+        char_index = ALPHABET.index(char)
+        raise ArgumentError, 'Value passed not a valid Base58 String.' if char_index.nil?
+        int_val = int_val * SIZE + char_index
       end
       s = int_val.to_even_length_hex
       s = '' if s == '00'

data/lib/bitcoin/bip324.rb

@@ -91,13 +91,16 @@ module Bitcoin
       ECDSA::Format::IntegerOctetString.encode(result, 32).bth
     end
 
+    # Number of cases xswiftec_inv selects between. It reads c as 3 bits, c & 1, c & 2 and c & 4.
+    CASE_COUNT = 8
+
     # Given a field element X on the curve, find (u, t) that encode them.
     # @param [String] x coordinate with hex format.
     # @return [String] ElligatorSwift public key with hex format.
     def xelligatorswift(x)
       loop do
         u = SecureRandom.random_number(1..ECDSA::Group::Secp256k1.order).to_s(16)
-        c = SecureRandom.random_number(9)
+        c = SecureRandom.random_number(CASE_COUNT)
         t = xswiftec_inv(x, u, c)
         unless t.nil?
           return (ECDSA::Format::IntegerOctetString.encode(u.hex, 32) +

data/lib/bitcoin/block.rb

@@ -28,7 +28,7 @@ module Bitcoin
       header = BlockHeader.new(
         version,
         '00' * 32,
-        Merkle::BinaryTree.new(config: Merkle::Config.bitcoin, leaves: [coinbase.txid]).compute_root.rhex,
+        Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: [coinbase.txid]).compute_root.rhex,
         time,
         bits,
         nonce
@@ -72,7 +72,7 @@ module Bitcoin
 
     # calculate merkle root from tx list.
     def calculate_merkle_root
-      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin, leaves: transactions.map(&:tx_hash))
+      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: transactions.map(&:tx_hash))
       tree.compute_root
     end
 
@@ -86,7 +86,7 @@ module Bitcoin
       witness_hashes = [COINBASE_WTXID]
       witness_hashes += (transactions[1..-1].map(&:witness_hash))
       reserved_value = transactions[0].inputs[0].script_witness.stack.map(&:bth).join
-      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin, leaves: witness_hashes)
+      tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: witness_hashes)
       root_hash = tree.compute_root
       Bitcoin.double_sha256([root_hash + reserved_value].pack('H*')).bth
     end

data/lib/bitcoin/key.rb

@@ -170,7 +170,7 @@ module Bitcoin
         else
           false
         end
-      rescue Exception
+      rescue StandardError
         false
       end
     end

data/lib/bitcoin/message/base.rb

@@ -32,11 +32,17 @@ module Bitcoin
         magic = buf.read(4)
         raise ArgumentError, 'Invalid magic.' unless magic == Bitcoin.chain_params.magic_head.htb
         command = buf.read(12).delete("\x00")
+        # The length is announced by the peer, so it is checked before it is used to read.
         length = buf.read(4).unpack1('V')
+        if length > MAX_PROTOCOL_MESSAGE_LENGTH
+          raise ArgumentError, "Payload must not be longer than #{MAX_PROTOCOL_MESSAGE_LENGTH} bytes."
+        end
         checksum = buf.read(4)
+        # read returns "" for a length of 0 and nil once the buffer is exhausted.
         payload = buf.read(length)
+        raise ArgumentError, 'Payload is shorter than the announced length.' unless payload&.bytesize == length
         raise ArgumentError, 'Checksum do not match.' unless checksum == Bitcoin.double_sha256(payload)[0...4]
-        Bitcoin::Message.decode(command, payload&.bth)
+        Bitcoin::Message.decode(command, payload.bth)
       end
 
     end

data/lib/bitcoin/message/filter_load.rb

@@ -22,8 +22,18 @@ module Bitcoin
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
         filter_count = Bitcoin.unpack_var_int_from_io(buf)
+        # A filterload message is received from an untrusted peer, so the limits which bound
+        # the work BloomFilter#add and #contains? perform have to be enforced here.
+        if filter_count > Bitcoin::BloomFilter::MAX_BLOOM_FILTER_SIZE
+          raise Bitcoin::Message::Error,
+                "filter size must be less than or equal to #{Bitcoin::BloomFilter::MAX_BLOOM_FILTER_SIZE}."
+        end
         filter = buf.read(filter_count).unpack('C*')
         func_count = buf.read(4).unpack1('V')
+        if func_count > Bitcoin::BloomFilter::MAX_HASH_FUNCS
+          raise Bitcoin::Message::Error,
+                "hash funcs must be less than or equal to #{Bitcoin::BloomFilter::MAX_HASH_FUNCS}."
+        end
         tweak = buf.read(4).unpack1('V')
         flag = buf.read(1).unpack1('C')
         FilterLoad.new(Bitcoin::BloomFilter.new(filter, func_count, tweak), flag)

data/lib/bitcoin/message/merkle_block.rb

@@ -28,6 +28,12 @@ module Bitcoin
         flag_count = Bitcoin.unpack_var_int_from_io(buf)
         # A sequence of bits packed eight in a byte with the least significant bit first.
         m.flags = buf.read(flag_count).bth
+        # Reject a tree an untrusted peer could use to exhaust memory or CPU in #partial_tree.
+        begin
+          Bitcoin::PartialTree.validate!(m.tx_count, m.hashes, Bitcoin.byte_to_bit(m.flags.htb))
+        rescue ArgumentError => e
+          raise Bitcoin::Message::Error, e.message
+        end
         m
       end
 

data/lib/bitcoin/message.rb

@@ -51,6 +51,9 @@ module Bitcoin
 
     USER_AGENT = "/bitcoinrb:#{Bitcoin::VERSION}/"
 
+    # The maximum payload size a peer may announce in a message header.
+    MAX_PROTOCOL_MESSAGE_LENGTH = 4_000_000
+
     SERVICE_FLAGS = {
         none: 0,
         network: 1 << 0,  # the node is capable of serving the block chain. It is currently set by all Bitcoin Core node, and is unset by SPV clients or other peers that just want network services but don't provide them.

data/lib/bitcoin/partial_tree.rb

@@ -4,6 +4,10 @@ module Bitcoin
   # For a complete Merkle tree implementation, migrate to the merkle gem.
   class PartialTree
 
+    # The maximum number of transactions a block can contain, so the maximum tx_count
+    # a valid merkleblock message can commit to.
+    MAX_TX_COUNT = MAX_BLOCK_WEIGHT / MIN_TRANSACTION_WEIGHT
+
     attr_accessor :root
 
     def initialize(root = nil)
@@ -15,7 +19,13 @@ module Bitcoin
     end
 
     # https://bitcoin.org/en/developer-reference#creating-a-merkleblock-message
+    # @param [Integer] tx_count The number of transactions in the block.
+    # @param [Array] hashes Array of hash values with hex format.
+    # @param [String] flags The sequence of bits, a string of '0' and '1'.
+    # @return [Bitcoin::PartialTree]
+    # @raise [ArgumentError] If the given parameters are out of range or inconsistent.
     def self.build(tx_count, hashes, flags)
+      validate!(tx_count, hashes, flags)
       flags = flags.each_char.map(&:to_i)
       root = build_initial_tree( Array.new(tx_count) { Node.new })
       current_node = root
@@ -37,7 +47,22 @@ module Bitcoin
       new(root)
     end
 
+    # Validate the parameters of a partial merkle tree.
+    # A merkleblock message is received from an untrusted peer, so these bounds are required
+    # to stop it from making #build allocate an unbounded number of nodes or loop forever.
+    # See Bitcoin Core's CPartialMerkleTree::ExtractMatches.
+    # @raise [ArgumentError]
+    def self.validate!(tx_count, hashes, flags)
+      raise ArgumentError, 'tx_count must be greater than 0.' unless tx_count.is_a?(Integer) && tx_count > 0
+      raise ArgumentError, "tx_count must be less than or equal to #{MAX_TX_COUNT}." if tx_count > MAX_TX_COUNT
+      # There can never be more hashes provided than one for every txid.
+      raise ArgumentError, 'hashes must not be greater than tx_count.' if hashes.size > tx_count
+      # There must be at least one bit per node in the partial tree, and at least one node per hash.
+      raise ArgumentError, 'flags must have at least one bit per hash.' if flags.size < hashes.size
+    end
+
     def self.build_initial_tree(nodes)
+      raise ArgumentError, 'nodes must not be empty.' if nodes.empty?
       while nodes.size != 1
         nodes = nodes.each_slice(2).map { |m|
           parent = Node.new

data/lib/bitcoin/psbt/input.rb

@@ -192,6 +192,13 @@ module Bitcoin
         payload
       end
 
+      # Get the previous output this input spends.
+      # @param [Integer] index The index of the outpoint this input refers to.
+      # @return [Bitcoin::TxOut] The previous output, or nil if this input does not carry it.
+      def utxo(index)
+        (non_witness_utxo ? non_witness_utxo.out[index] : nil) || witness_utxo
+      end
+
       # Check whether input's scriptPubkey is correct witness.
       # @return [Boolean]
       def valid_witness_input?

data/lib/bitcoin/psbt/tx.rb

@@ -277,16 +277,17 @@ module Bitcoin
           extract_tx.in[index].script_sig = input.final_script_sig if input.final_script_sig
           extract_tx.in[index].script_witness = input.final_script_witness if input.final_script_witness
         end
+        # A taproot sighash commits to every prevout of the tx, see BIP-341, so they are all
+        # collected before any input is verified.
+        prevouts = extract_tx.in.each_with_index.map do |tx_in, index|
+          utxo = inputs[index].utxo(tx_in.out_point.index)
+          raise ArgumentError, "input[#{index}] does not have utxo." unless utxo
+          utxo
+        end
         # validate signature
-        extract_tx.in.each_with_index do |tx_in, index|
-          input = inputs[index]
-          if input.non_witness_utxo
-            utxo = input.non_witness_utxo.out[tx_in.out_point.index]
-            raise "input[#{index}]'s signature is invalid.'" unless extract_tx.verify_input_sig(index, utxo.script_pubkey)
-          else
-            utxo = input.witness_utxo
-            raise ArgumentError, "input[#{index}] does not have utxo." unless utxo
-            raise "input[#{index}]'s signature is invalid.'" unless extract_tx.verify_input_sig(index, utxo.script_pubkey, amount: utxo.value)
+        prevouts.each_with_index do |utxo, index|
+          unless extract_tx.verify_input_sig(index, utxo.script_pubkey, amount: utxo.value, prevouts: prevouts)
+            raise "input[#{index}]'s signature is invalid.'"
           end
         end
         extract_tx

data/lib/bitcoin/rpc/bitcoin_core_client.rb

@@ -61,8 +61,9 @@ module Bitcoin
         request.content_type = 'application/json'
         request.body = data.to_json
         response = http.request(request)
-        body = response.body
-        json_data = JSON.parse(body.gsub(/\\u([\da-fA-F]{4})/) { [$1].pack('H*').unpack('n*').pack('U*').encode('ISO-8859-1').force_encoding('UTF-8') })
+        # Unescape \uXXXX with JSON.parse itself. Doing it beforehand lets a " contained in
+        # a string value close that string and inject arbitrary JSON into the parsed result.
+        json_data = JSON.parse(response.body)
         response = convert_floats_to_strings(json_data)
         raise response['error'].to_json if response['error']
         response['result']

data/lib/bitcoin/script/script.rb

@@ -124,7 +124,7 @@ module Bitcoin
         segwit_addr = Bech32::SegwitAddr.new(addr)
         raise ArgumentError, 'Invalid address.' unless Bitcoin.chain_params.bech32_hrp == segwit_addr.hrp
         Bitcoin::Script.parse_from_payload(segwit_addr.to_script_pubkey.htb)
-      rescue Exception => e
+      rescue StandardError => e
         begin
         hex, addr_version = Bitcoin.decode_base58_address(addr)
         rescue

data/lib/bitcoin/script/script_interpreter.rb

@@ -568,7 +568,7 @@ module Bitcoin
         end
       rescue ScriptNumError => e
         return set_error(SCRIPT_ERR_SCRIPTNUM, e.message)
-      rescue Exception => e
+      rescue StandardError => e
         return set_error(SCRIPT_ERR_UNKNOWN_ERROR, e.message)
       end
 

data/lib/bitcoin/script/tx_checker.rb

@@ -30,7 +30,7 @@ module Bitcoin
       begin
         key = Key.new(pubkey: pubkey, key_type: key_type, allow_hybrid: allow_hybrid)
         key.verify(sig, sighash)
-      rescue Exception
+      rescue StandardError
         false
       end
     end
@@ -40,9 +40,14 @@ module Bitcoin
     # @param [String] pubkey a public key with hex format.
     # @param [Symbol] sig_version whether :taproot or :tapscript
     # @return [Boolean] verification result
+    # @raise [ArgumentError] If +prevouts+ does not cover every input of the tx.
     def check_schnorr_sig(sig, pubkey, sig_version, opts = {})
       return false unless [:taproot, :tapscript].include?(sig_version)
-      return false if prevouts.size < input_index
+      # A taproot sighash commits to the amount and scriptPubkey of every prevout, so a partial
+      # set does not fail to verify, it verifies against a sighash consensus never computes.
+      # Checked here rather than left to the generator, since the rescue below would turn it
+      # into a script error.
+      raise ArgumentError, 'prevouts must be specified for all inputs.' unless prevouts.size == tx.in.size
 
       sig = sig.htb
       return set_error(SCRIPT_ERR_SCHNORR_SIG_SIZE) unless [64, 65].include?(sig.bytesize)

data/lib/bitcoin/secp256k1/native.rb

@@ -6,7 +6,8 @@ module Bitcoin
   module Secp256k1
 
     # binding for secp256k1 (https://github.com/bitcoin-core/secp256k1/)
-    # tag: v0.4.0
+    # tag: v0.8.0, which secp256k1rb 0.8.0 binds the public API of. An older library is missing
+    # symbols the gem attaches, such as secp256k1_ec_pubkey_sort and the musig module.
     # this is not included by default, to enable set shared object path to ENV['SECP256K1_LIB_PATH']
     # for linux, ENV['SECP256K1_LIB_PATH'] = '/usr/local/lib/libsecp256k1.so' or '/usr/lib64/libsecp256k1.so'
     # for mac,
@@ -98,6 +99,54 @@ module Bitcoin
           raise ArgumentError, "unknown algo: #{algo}"
         end
       end
+
+      # Whether the loaded library supports BIP-352 silent payments.
+      # The module exists in libsecp256k1 v0.8.0 or later.
+      # @return [Boolean]
+      def sp_available?
+        silentpayments_available?
+      end
+
+      # Create the silent payment outputs for +recipients+.
+      # @param [Array] recipients An array of [scan public key, spend public key], both with hex
+      # format(33 bytes). A recipient may appear more than once.
+      # @param [String] outpoint_smallest The lexicographically smallest outpoint of the tx inputs
+      # with hex format(36 bytes).
+      # @param [Array] plain_seckeys Private keys of the non-taproot inputs with hex format.
+      # @param [Array] taproot_seckeys Private keys of the taproot inputs with hex format.
+      # @return [Array] An x-only public key with hex format for each recipient, in the same order.
+      # @raise [Secp256k1::Error] If the outputs could not be created.
+      def sp_create_outputs(recipients, outpoint_smallest, plain_seckeys: [], taproot_seckeys: [])
+        silentpayments_sender_create_outputs(
+          recipients, outpoint_smallest, plain_seckeys: plain_seckeys, taproot_seckeys: taproot_seckeys)
+      end
+
+      # Create the label and the label tweak of the +m+ th label of +scan_key+.
+      # @param [String] scan_key The recipient's scan private key with hex format(32 bytes).
+      # @param [Integer] m The label index.
+      # @return [Array] The serialized label(33 bytes) and its tweak(32 bytes), both with hex format.
+      def sp_create_label(scan_key, m)
+        silentpayments_create_label(scan_key, m)
+      end
+
+      # Scan +tx_outputs+ for the silent payment outputs of the recipient.
+      # @param [Array] tx_outputs The x-only public key of each taproot output with hex format.
+      # @param [String] scan_key The recipient's scan private key with hex format(32 bytes).
+      # @param [String] outpoint_smallest The lexicographically smallest outpoint of the tx inputs
+      # with hex format(36 bytes).
+      # @param [String] spend_pubkey The recipient's spend public key with hex format(33 bytes).
+      # @param [Array] plain_pubkeys Public keys of the non-taproot inputs with hex format(33 bytes).
+      # @param [Array] xonly_pubkeys X-only public keys of the taproot inputs with hex format.
+      # @param [Hash] labels A serialized label to label tweak map, both with hex format.
+      # @return [Array] A hash per found output, with the :output, :tweak and :label keys.
+      # @raise [Secp256k1::Error] If the tx is not a silent payment transaction.
+      def sp_scan_outputs(tx_outputs, scan_key, outpoint_smallest, spend_pubkey,
+                          plain_pubkeys: [], xonly_pubkeys: [], labels: {})
+        summary = silentpayments_create_prevouts_summary(
+          outpoint_smallest, plain_pubkeys: plain_pubkeys, xonly_pubkeys: xonly_pubkeys)
+        silentpayments_scan_outputs(
+          tx_outputs, scan_key, summary, spend_pubkey, labels: labels.empty? ? nil : labels)
+      end
     end
   end
 end

data/lib/bitcoin/secp256k1/ruby.rb

@@ -45,7 +45,7 @@ module Bitcoin
         return false unless pubkey.bytesize == X_ONLY_PUBKEY_SIZE
         begin
           ECDSA::Format::PointOctetString.decode(pubkey, ECDSA::Group::Secp256k1)
-        rescue Exception
+        rescue StandardError
           return false
         end
         true
@@ -201,7 +201,7 @@ module Bitcoin
           k = ECDSA::Format::PointOctetString.decode(repack_pubkey(pubkey), GROUP)
           signature = ECDSA::Format::SignatureDerString.decode(sig)
           ECDSA.valid_signature?(k, data, signature)
-        rescue Exception
+        rescue StandardError
           false
         end
       end
@@ -210,6 +210,119 @@ module Bitcoin
         Schnorr.valid_sig?(data, pubkey.htb, sig)
       end
 
+      # Whether this module supports BIP-352 silent payments.
+      # @return [Boolean]
+      def sp_available?
+        true
+      end
+
+      # Create the silent payment outputs for +recipients+.
+      # See Bitcoin::Secp256k1::Native#sp_create_outputs for the parameters.
+      # @return [Array] An x-only public key with hex format for each recipient, in the same order.
+      # @raise [ArgumentError] If the input private keys sum to zero.
+      def sp_create_outputs(recipients, outpoint_smallest, plain_seckeys: [], taproot_seckeys: [])
+        field = ECDSA::PrimeField.new(GROUP.order)
+        sum = sp_sum_seckeys(plain_seckeys, taproot_seckeys, field)
+        raise ArgumentError, 'The input private keys sum to zero.' if sum.zero?
+        agg_pubkey = (GROUP.generator.to_jacobian * sum).to_affine
+        input_hash = Bitcoin.tagged_hash('BIP0352/Inputs', outpoint_smallest.htb + agg_pubkey.to_hex.htb)
+
+        # k counts up within the group of recipients sharing a scan key, but an output keeps the
+        # position of the recipient it pays.
+        groups = {}
+        recipients.each_with_index do |(scan_pubkey, spend_pubkey), index|
+          (groups[scan_pubkey] ||= []) << [spend_pubkey, index]
+        end
+        results = Array.new(recipients.length)
+        groups.each do |scan_pubkey, spends|
+          scan_point = Bitcoin::Key.new(pubkey: scan_pubkey).to_point.to_jacobian
+          shared_secret = (scan_point * field.mod(input_hash.bti * sum)).to_affine.to_hex.htb
+          spends.each_with_index do |(spend_pubkey, index), k|
+            t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', shared_secret + [k].pack('N'))
+            spend_point = Bitcoin::Key.new(pubkey: spend_pubkey).to_point.to_jacobian
+            output = (spend_point + GROUP.generator.to_jacobian * t_k.bti).to_affine
+            results[index] = sp_xonly(output.x)
+          end
+        end
+        results
+      end
+
+      # Create the label and the label tweak of the +m+ th label of +scan_key+.
+      # See Bitcoin::Secp256k1::Native#sp_create_label for the parameters.
+      # @return [Array] The serialized label(33 bytes) and its tweak(32 bytes), both with hex format.
+      def sp_create_label(scan_key, m)
+        tweak = Bitcoin.tagged_hash('BIP0352/Label', scan_key.htb + [m].pack('N'))
+        [(GROUP.generator.to_jacobian * tweak.bti).to_affine.to_hex(true), tweak.bth]
+      end
+
+      # Scan +tx_outputs+ for the silent payment outputs of the recipient.
+      # See Bitcoin::Secp256k1::Native#sp_scan_outputs for the parameters.
+      # @return [Array] A hash per found output, with the :output, :tweak and :label keys.
+      # @raise [ArgumentError] If the input public keys sum to the point at infinity.
+      def sp_scan_outputs(tx_outputs, scan_key, outpoint_smallest, spend_pubkey,
+                          plain_pubkeys: [], xonly_pubkeys: [], labels: {})
+        field = ECDSA::PrimeField.new(GROUP.order)
+        sum_pubkeys = GROUP.infinity.to_jacobian
+        plain_pubkeys.each { |p| sum_pubkeys += Bitcoin::Key.new(pubkey: p).to_point.to_jacobian }
+        xonly_pubkeys.each { |p| sum_pubkeys += Bitcoin::Key.from_xonly_pubkey(p).to_point.to_jacobian }
+        raise ArgumentError, 'The input public keys sum to the point at infinity.' if sum_pubkeys.infinity?
+
+        input_hash = Bitcoin.tagged_hash(
+          'BIP0352/Inputs', outpoint_smallest.htb + sum_pubkeys.to_affine.to_hex.htb)
+        shared_secret = (sum_pubkeys * field.mod(input_hash.bti * scan_key.to_i(16))).to_affine.to_hex.htb
+        spend_point = Bitcoin::Key.new(pubkey: spend_pubkey).to_point.to_jacobian
+        # A labeled output is P_k + label. Only the x coordinate is compared, which covers the
+        # label of either parity without negating the output.
+        label_points = labels.map do |label, tweak|
+          [label, tweak, Bitcoin::Key.new(pubkey: label).to_point.to_jacobian]
+        end
+
+        results = []
+        remaining = tx_outputs.map(&:downcase)
+        k = 0
+        while k < Bitcoin::SilentPayment::K_MAX
+          t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', shared_secret + [k].pack('N'))
+          p_k = GROUP.generator.to_jacobian * t_k.bti + spend_point
+          index = remaining.index(sp_xonly(p_k.to_affine.x))
+          found = if index
+                    {output: remaining.delete_at(index), tweak: t_k.bth, label: nil}
+                  else
+                    sp_find_labeled(p_k, remaining, label_points, t_k, field)
+                  end
+          break unless found
+          results << found
+          k += 1
+        end
+        results
+      end
+
+      # Sum the private keys of the inputs, negating a taproot key whose public key has odd y.
+      def sp_sum_seckeys(plain_seckeys, taproot_seckeys, field)
+        sum = plain_seckeys.inject(0) { |total, sk| field.mod(total + sk.to_i(16)) }
+        taproot_seckeys.inject(sum) do |total, sk|
+          d = sk.to_i(16)
+          d = field.mod(-d) unless (GROUP.generator.to_jacobian * d).to_affine.has_even_y?
+          field.mod(total + d)
+        end
+      end
+
+      # Find the output +p_k+ pays through one of +label_points+, or nil.
+      def sp_find_labeled(p_k, remaining, label_points, t_k, field)
+        label_points.each do |label, tweak, point|
+          index = remaining.index(sp_xonly((p_k + point).to_affine.x))
+          next unless index
+          return {output: remaining.delete_at(index),
+                  tweak: sp_xonly(field.mod(t_k.bti + tweak.to_i(16))),
+                  label: label}
+        end
+        nil
+      end
+
+      # Serialize a field element as a 32 byte value with hex format.
+      def sp_xonly(value)
+        ECDSA::Format::IntegerOctetString.encode(value, 32).bth
+      end
+
     end
   end
 end

data/lib/bitcoin/sighash_generator.rb

@@ -107,8 +107,14 @@ module Bitcoin
       # - leaf_hash: leaf hash with binary format if sig_version is :tapscript, it required
       # - last_code_separator_pos: the position of last code separator
       # @return [String] signature hash with binary format.
+      # @raise [ArgumentError] If +opts[:prevouts]+ does not cover every input of the tx.
       def generate(tx, input_index, hash_type, opts)
         raise ArgumentError, 'Invalid sig_version was specified.' unless [:taproot, :tapscript].include?(opts[:sig_version])
+        # sha_amounts and sha_scriptpubkeys commit to every prevout, so a partial set silently
+        # produces a sighash which is not the one consensus computes for this tx.
+        unless opts[:prevouts].is_a?(Array) && opts[:prevouts].size == tx.in.size
+          raise ArgumentError, 'prevouts must be specified for all inputs.'
+        end
 
         ext_flag = opts[:sig_version] == :taproot ? 0 : 1
         key_version = 0

data/lib/bitcoin/silent_payment.rb

@@ -1,5 +1,3 @@
-require 'set'
-
 module Bitcoin
   # BIP-352 silent payment module.
   # @see https://github.com/bitcoin/bips/blob/master/bip-0352.mediawiki
@@ -16,7 +14,7 @@ module Bitcoin
     # @param [Array<Bitcoin::Script>] prevouts An array of previous output script.
     # @param [Array<Bitcoin::Key>] private_keys An array of Bitcoin::Key objects corresponding to each public key in prevouts.
     # @param [Array<Bech32::SilentPaymentAddr>] recipients
-    # @return [Array<ECDSA::Point>] An array of derived points.
+    # @return [Array<ECDSA::Point>] An array of derived points, one per recipient in the same order.
     # @raise [ArgumentError]
     def derive_payment_points(prevouts, private_keys, recipients)
       raise ArgumentError, "prevouts must be Array." unless prevouts.is_a? Array
@@ -24,53 +22,41 @@ module Bitcoin
       raise ArgumentError, "prevouts and private_keys must be the same length." unless prevouts.length == private_keys.length
       raise ArgumentError, "recipients must be Array." unless recipients.is_a? Array
 
-      input_pub_keys = []
       field = ECDSA::PrimeField.new(Bitcoin::Secp256k1::GROUP.order)
+      plain_seckeys = []
+      taproot_seckeys = []
       sum_priv_keys = 0
       prevouts.each_with_index do |prevout, index|
         key = private_keys[index]
         raise ArgumentError, "private_keys element must be Bitcoin::Key." unless key.is_a? Bitcoin::Key
-        priv_key_int = key.priv_key.to_i(16)
         public_key = extract_public_key(prevout, inputs[index])
         next if public_key.nil?
-        private_key = if public_key.p2tr? && key.to_point.y.odd?
-                        field.mod(-priv_key_int)
-                      else
-                        priv_key_int
-                      end
-        input_pub_keys << public_key
-        sum_priv_keys = field.mod(sum_priv_keys + private_key)
+        priv_key_int = key.priv_key.to_i(16)
+        if public_key.p2tr?
+          taproot_seckeys << key.priv_key
+          priv_key_int = field.mod(-priv_key_int) unless key.to_point.has_even_y?
+        else
+          plain_seckeys << key.priv_key
+        end
+        sum_priv_keys = field.mod(sum_priv_keys + priv_key_int)
       end
-      agg_pubkey = (Bitcoin::Secp256k1::GROUP.generator.to_jacobian * sum_priv_keys).to_affine
-      return [] if agg_pubkey.infinity?
-
-      outpoint_l = inputs.map{|i|i.out_point.to_hex}.sort.first
-
-      input_hash = Bitcoin.tagged_hash("BIP0352/Inputs", outpoint_l.htb + agg_pubkey.to_hex.htb).bth
+      return [] if plain_seckeys.empty? && taproot_seckeys.empty?
+      # The input private keys sum to zero, so the aggregate public key is the point at infinity
+      # and no shared secret exists.
+      return [] if sum_priv_keys.zero?
 
-      destinations = {}
-      recipients.each do |sp_addr|
+      destinations = recipients.map do |sp_addr|
         raise ArgumentError, "recipients element must be Bech32::SilentPaymentAddr." unless sp_addr.is_a? Bech32::SilentPaymentAddr
-        destinations[sp_addr.scan_key] = [] unless destinations.has_key?(sp_addr.scan_key)
-        destinations[sp_addr.scan_key] << sp_addr.spend_key
+        [sp_addr.scan_key, sp_addr.spend_key]
       end
-
-      # Check K_max limit: fail if any group exceeds the limit
-      destinations.each_value do |spends|
-        raise ArgumentError, "Recipient group exceeds K_max limit (#{K_MAX})." if spends.length > K_MAX
+      destinations.group_by(&:first).each_value do |group|
+        raise ArgumentError, "Recipient group exceeds K_max limit (#{K_MAX})." if group.length > K_MAX
       end
 
-      outputs = []
-      destinations.each do |scan_key, spends|
-        scan_key = Bitcoin::Key.new(pubkey: scan_key).to_point.to_jacobian
-        ecdh_shared_secret = (scan_key * field.mod(input_hash.to_i(16) * sum_priv_keys)).to_affine.to_hex.htb
-        spends.each.with_index do |spend, i|
-          t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', ecdh_shared_secret + [i].pack('N'))
-          spend_key = Bitcoin::Key.new(pubkey: spend).to_point.to_jacobian
-          outputs << (spend_key + Bitcoin::Secp256k1::GROUP.generator.to_jacobian * t_k.bth.to_i(16)).to_affine
-        end
-      end
-      outputs
+      Bitcoin.secp_impl.sp_create_outputs(
+        destinations, sp_outpoint_smallest,
+        plain_seckeys: plain_seckeys, taproot_seckeys: taproot_seckeys
+      ).map { |xonly| Bitcoin::Key.from_xonly_pubkey(xonly).to_point }
     end
 
 
@@ -87,8 +73,11 @@ module Bitcoin
       raise ArgumentError, "scan_private_key must be Bitcoin::Key." unless scan_private_key.is_a? Bitcoin::Key
       raise ArgumentError, "spend_pubkey must be Bitcoin::Key." unless spend_pubkey.is_a? Bitcoin::Key
 
-      has_taproot = !outputs.find{|o| o.script_pubkey.p2tr? }.nil?
-      return [] unless has_taproot
+      taproot_outputs = outputs.select{|o| o.script_pubkey.p2tr? }
+      return [] if taproot_outputs.empty?
+
+      plain_pubkeys = []
+      xonly_pubkeys = []
       sum_pub_keys = Bitcoin::Secp256k1::GROUP.infinity.to_jacobian
       maximum_witness_version = Bitcoin::Opcodes.opcode_to_small_int(Bitcoin::Opcodes::OP_1)
       prevouts.each.with_index do |prevout, index|
@@ -96,64 +85,41 @@ module Bitcoin
 
         public_key = extract_public_key(prevout, inputs[index])
         next if public_key.nil?
+        if public_key.p2tr?
+          xonly_pubkeys << public_key.xonly_pubkey
+        else
+          plain_pubkeys << public_key.pubkey
+        end
         sum_pub_keys += public_key.to_point.to_jacobian
       end
+      return [] if plain_pubkeys.empty? && xonly_pubkeys.empty?
+      # Not a silent payment transaction, so there is nothing to find. Checked here rather than
+      # left to the implementation, which reports it as an error.
       return [] if sum_pub_keys.infinity?
 
-      field = ECDSA::PrimeField.new(Bitcoin::Secp256k1::GROUP.order)
-      outpoint_l = inputs.map{|i|i.out_point.to_hex}.sort.first
-      input_hash = Bitcoin.tagged_hash("BIP0352/Inputs", outpoint_l.htb + sum_pub_keys.to_affine.to_hex.htb).bth
-      ecdh_shared_secret = (sum_pub_keys * field.mod(input_hash.to_i(16) * scan_private_key.priv_key.to_i(16))).to_affine.to_hex.htb
-
-      # Pre-compute label tweak points with their label values and scalar tweaks
-      label_tweaks = labels.map do |m|
-        label_tweak = Bitcoin.tagged_hash('BIP0352/Label', scan_private_key.priv_key.htb + [m].pack('N'))
-        label_point = Bitcoin::Secp256k1::GROUP.generator.to_jacobian * label_tweak.bti
-        [m, label_tweak, label_point]
+      impl = Bitcoin.secp_impl
+      label_values = {}
+      label_tweaks = {}
+      labels.each do |m|
+        label, tweak = impl.sp_create_label(scan_private_key.priv_key, m)
+        label_values[label] = m
+        label_tweaks[label] = tweak
       end
 
-      k = 0
-      results = []
-      found_outputs = Set.new
-      loop do
-        # Stop scanning if K_max limit is reached
-        break if k == K_MAX
-
-        t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', ecdh_shared_secret + [k].pack('N'))
-        p_k = Bitcoin::Secp256k1::GROUP.generator.to_jacobian * t_k.bti + spend_pubkey.to_point.to_jacobian
-        found = false
-        outputs.each do |output|
-          next unless output.script_pubkey.p2tr?
-          next if found_outputs.include?(output)
-          output_pubkey = Bitcoin::Key.from_xonly_pubkey(output.script_pubkey.witness_data[1].bth)
-
-          # Check basic match (no label)
-          if p_k.to_affine.x == output_pubkey.to_point.x
-            results << SilentPayment::Output.new(output, t_k)
-            found_outputs << output
-            k += 1
-            found = true
-            break
-          end
-
-          # Check labeled matches
-          label_tweaks.each do |label_value, label_tweak_scalar, label_point|
-            p_k_labeled = p_k + label_point
-            if p_k_labeled.to_affine.x == output_pubkey.to_point.x
-              # Full tweak is t_k + label_tweak (mod order)
-              full_tweak = field.mod(t_k.bti + label_tweak_scalar.bti).to_s(16).rjust(64, '0').htb
-              results << SilentPayment::Output.new(output, full_tweak, label_value)
-              found_outputs << output
-              k += 1
-              found = true
-              break
-            end
-          end
-          break if found
-        end
-        break unless found
+      tx_outputs = taproot_outputs.map{|o| o.script_pubkey.witness_data[1].bth }
+      impl.sp_scan_outputs(tx_outputs, scan_private_key.priv_key, sp_outpoint_smallest, spend_pubkey.pubkey,
+                           plain_pubkeys: plain_pubkeys, xonly_pubkeys: xonly_pubkeys,
+                           labels: label_tweaks).map do |found|
+        tx_out = taproot_outputs[tx_outputs.index(found[:output])]
+        SilentPayment::Output.new(tx_out, found[:tweak].htb, found[:label] && label_values[found[:label]])
       end
-      results
+    end
+
+    # The lexicographically smallest outpoint of this tx's inputs, which the input hash of
+    # BIP-352 commits to.
+    # @return [String] The outpoint with hex format(36 bytes).
+    def sp_outpoint_smallest
+      inputs.map{|i| i.out_point.to_hex }.min
     end
 
     # Extract public keys from +prevout+ and input.

data/lib/bitcoin/taproot/custom_depth_builder.rb

@@ -35,14 +35,14 @@ module Bitcoin
 
       def merkle_root
         return '' if tree.empty?
-        script_tree = Merkle::CustomTree.new(config: Merkle::Config.taptree, leaves: extract_leaves(tree))
+        script_tree = Merkle::CustomTree.new(config: Merkle::Config.taptree(element_encoding: :hex), leaves: extract_leaves(tree))
         script_tree.compute_root
       end
 
       def extract_leaves(leaves)
         leaves.map do |leaf|
           if leaf.is_a?(Bitcoin::Taproot::LeafNode)
-            leaf.leaf_hash
+            leaf.leaf_hash.bth
           elsif leaf.is_a?(Array)
             extract_leaves(leaf)
           end

data/lib/bitcoin/taproot/simple_builder.rb

@@ -100,15 +100,17 @@ module Bitcoin
       private
 
       def script_tree
-        leaves = []
+        # A node holding one child hashes to that child, so the tree rejects the shape as
+        # indistinguishable from the child itself. A branch of one leaf, and a tree of one
+        # branch, are therefore that leaf and that branch rather than a node above them.
+        tree = nil
         branches.each do |pair|
-          if leaves.empty? || leaves.length == 1
-            leaves << pair.map(&:leaf_hash)
-          elsif leaves.length == 2
-            leaves = [leaves, pair.map(&:leaf_hash)]
-          end
+          hashes = pair.map { |leaf| leaf.leaf_hash.bth }
+          node = hashes.length == 1 ? hashes.first : hashes
+          tree = tree.nil? ? node : [tree, node]
         end
-        Merkle::CustomTree.new(config: Merkle::Config.taptree, leaves: leaves)
+        leaves = tree.is_a?(Array) ? tree : [tree]
+        Merkle::CustomTree.new(config: Merkle::Config.taptree(element_encoding: :hex), leaves: leaves)
       end
 
       def merkle_root

data/lib/bitcoin/taproot.rb

@@ -33,7 +33,12 @@ module Bitcoin
     def tweak_public_key(internal_key, merkle_root)
       t = tweak(internal_key, merkle_root)
       key = Bitcoin::Key.new(priv_key: t.bth, key_type: Key::TYPES[:compressed])
-      Bitcoin::Key.from_point(key.to_point + internal_key.to_point)
+      # BIP-341 tweaks lift_x(P), the point with even y. #tweak commits to the x-only key and
+      # #tweak_private_key negates the private key to match, so the point is lifted here too.
+      # An internal key with odd y would otherwise give a Q the tweaked private key cannot spend.
+      internal_point = internal_key.to_point
+      internal_point = internal_point.negate unless internal_point.has_even_y?
+      Bitcoin::Key.from_point(key.to_point + internal_point)
     end
 
     # Generate tweak private key

data/lib/bitcoin/util.rb

@@ -152,7 +152,7 @@ module Bitcoin
       begin
         Bitcoin::Script.parse_from_addr(addr)
         true
-      rescue Exception
+      rescue StandardError
         false
       end
     end

data/lib/bitcoin/version.rb

@@ -1,3 +1,3 @@
 module Bitcoin
-  VERSION = "1.13.0"
+  VERSION = "1.14.0"
 end

data/lib/bitcoin/wallet/master_key.rb

@@ -8,15 +8,36 @@ module Bitcoin
       include Bitcoin::Util
       include Bitcoin::KeyPath
 
+      # The seed is not encrypted.
+      NOT_ENCRYPTED = 0
+      # AES-256-CBC with a key derived by PBKDF2-HMAC-SHA1. Only supported to load a wallet
+      # which was already encrypted, #encrypt always writes ENCRYPTED_V2.
+      ENCRYPTED_V1 = 1
+      # AES-256-GCM with a key derived by PBKDF2-HMAC-SHA512.
+      ENCRYPTED_V2 = 2
+
+      ENCRYPTION_VERSIONS = [ENCRYPTED_V1, ENCRYPTED_V2]
+
+      V1_KDF_ROUNDS = 2000
+      # Rounds for PBKDF2-HMAC-SHA512, which take roughly 100 ms.
+      KDF_ROUNDS = 210_000
+
+      SALT_SIZE = 16
+      GCM_IV_SIZE = 12
+      GCM_TAG_SIZE = 16
+
       attr_reader :seed
       attr_accessor :salt
       attr_accessor :encrypted
+      # The encryption version of +seed+, nil unless encrypted.
+      attr_reader :encryption_version
       attr_accessor :mnemonic # ephemeral data existing only at initialization
 
-      def initialize(seed, salt: '', encrypted: false, mnemonic: nil)
+      def initialize(seed, salt: '', encrypted: false, mnemonic: nil, encryption_version: nil)
         @mnemonic = mnemonic
         @seed = seed
         @encrypted = encrypted
+        @encryption_version = encrypted ? (encryption_version || ENCRYPTED_V2) : nil
         @salt = salt
       end
 
@@ -42,17 +63,18 @@ module Bitcoin
       # @return [Bitcoin::Wallet::MasterKey]
       def self.parse_from_payload(payload)
         flag, payload = unpack_var_int(payload)
-        raise 'encrypted flag is invalid.' unless [0, 1].include?(flag)
+        raise 'encrypted flag is invalid.' unless [NOT_ENCRYPTED, *ENCRYPTION_VERSIONS].include?(flag)
         salt, payload = unpack_var_string(payload)
         salt = '' unless salt
         seed, payload = unpack_var_string(payload)
-        self.new(seed.bth, salt: salt.bth, encrypted: flag == 1)
+        self.new(seed.bth, salt: salt.bth,
+                 encrypted: flag != NOT_ENCRYPTED, encryption_version: flag)
       end
 
       # generate payload with following format
-      # [encrypted(false:0, true:1)][salt(var str)][seed(var str)]
+      # [encryption version(not encrypted:0, v1:1, v2:2)][salt(var str)][seed(var str)]
       def to_payload
-        flg = encrypted ? 1 : 0
+        flg = encrypted ? encryption_version : NOT_ENCRYPTED
         pack_var_int(flg) << [salt, seed].map{|v|pack_var_string(v.htb)}.join
       end
 
@@ -71,39 +93,76 @@ module Bitcoin
         derived_key
       end
 
-      # encrypt seed
+      # Encrypt the seed with +passphrase+.
+      # The stored seed is [IV(12 bytes)][auth tag(16 bytes)][ciphertext].
+      # @param [String] passphrase
       def encrypt(passphrase)
         raise 'The wallet is already encrypted.' if encrypted
-        @salt = SecureRandom.hex(16)
-        enc = OpenSSL::Cipher.new('AES-256-CBC')
+        salt = SecureRandom.bytes(SALT_SIZE)
+        iv = SecureRandom.bytes(GCM_IV_SIZE)
+        enc = OpenSSL::Cipher.new('AES-256-GCM')
         enc.encrypt
-        enc.key, enc.iv = key_iv(enc, passphrase)
-        encrypted_data = ''
-        encrypted_data << enc.update(seed)
-        encrypted_data << enc.final
-        @seed = encrypted_data.bth
+        enc.key = derive_key(passphrase, salt, enc.key_len)
+        enc.iv = iv
+        encrypted_data = enc.update(seed) << enc.final
+        @salt = salt.bth
+        @seed = (iv + enc.auth_tag(GCM_TAG_SIZE) + encrypted_data).bth
+        @encryption_version = ENCRYPTED_V2
         @encrypted = true
       end
 
-      # decrypt seed
+      # Decrypt the seed with +passphrase+.
+      # @param [String] passphrase
+      # @raise [ArgumentError] If +passphrase+ is wrong or the encrypted seed is corrupted.
       def decrypt(passphrase)
         raise 'The wallet is not encrypted.' unless encrypted
-        dec = OpenSSL::Cipher.new('AES-256-CBC')
-        dec.decrypt
-        dec.key, dec.iv = key_iv(dec, passphrase)
-        decrypted_data = ''
-        decrypted_data << dec.update(seed.htb)
-        decrypted_data << dec.final
-        @seed = decrypted_data
+        @seed = encryption_version == ENCRYPTED_V1 ? decrypt_v1(passphrase) : decrypt_v2(passphrase)
         @encrypted = false
+        @encryption_version = nil
         @salt = ''
       end
 
       private
 
-      def key_iv(enc, passphrase)
-        key_iv = OpenSSL::PKCS5.pbkdf2_hmac_sha1(passphrase, salt, 2000, enc.key_len + enc.iv_len)
-        [key_iv[0, enc.key_len], key_iv[enc.key_len, enc.iv_len]]
+      # Derive an encryption key from +passphrase+.
+      # @param [String] passphrase
+      # @param [String] salt Salt with binary format.
+      # @param [Integer] length Key length in bytes.
+      # @return [String] Derived key with binary format.
+      def derive_key(passphrase, salt, length)
+        OpenSSL::PKCS5.pbkdf2_hmac(passphrase, salt, KDF_ROUNDS, length, OpenSSL::Digest::SHA512.new)
+      end
+
+      # Decrypt a seed stored by ENCRYPTED_V2.
+      # A wrong passphrase is rejected by the GCM authentication tag.
+      def decrypt_v2(passphrase)
+        data = seed.htb
+        raise ArgumentError, 'The encrypted seed is too short.' if data.bytesize <= GCM_IV_SIZE + GCM_TAG_SIZE
+        dec = OpenSSL::Cipher.new('AES-256-GCM')
+        dec.decrypt
+        dec.key = derive_key(passphrase, salt.htb, dec.key_len)
+        dec.iv = data[0...GCM_IV_SIZE]
+        dec.auth_tag = data[GCM_IV_SIZE...(GCM_IV_SIZE + GCM_TAG_SIZE)]
+        decrypt_with(dec, data[(GCM_IV_SIZE + GCM_TAG_SIZE)..-1])
+      end
+
+      # Decrypt a seed stored by ENCRYPTED_V1.
+      # That scheme has no authentication, so a wrong passphrase is only detected by the CBC
+      # padding and passes with a probability of about 1/256, yielding a garbage seed.
+      def decrypt_v1(passphrase)
+        dec = OpenSSL::Cipher.new('AES-256-CBC')
+        dec.decrypt
+        # The salt was passed to PBKDF2 as the hex string it is stored as, not as its bytes.
+        key_iv = OpenSSL::PKCS5.pbkdf2_hmac_sha1(passphrase, salt, V1_KDF_ROUNDS, dec.key_len + dec.iv_len)
+        dec.key = key_iv[0, dec.key_len]
+        dec.iv = key_iv[dec.key_len, dec.iv_len]
+        decrypt_with(dec, seed.htb)
+      end
+
+      def decrypt_with(dec, data)
+        dec.update(data) << dec.final
+      rescue OpenSSL::Cipher::CipherError
+        raise ArgumentError, 'Invalid passphrase.'
       end
 
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bitcoinrb
 version: !ruby/object:Gem::Version
-  version: 1.13.0
+  version: 1.14.0
 platform: ruby
 authors:
 - azuchi
@@ -113,14 +113,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: logger
   requirement: !ruby/object:Gem::Requirement
@@ -141,14 +141,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 1.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.3.0
+        version: 1.0.0
 - !ruby/object:Gem::Dependency
   name: dnsruby
   requirement: !ruby/object:Gem::Requirement