secp256k1rb 0.2.0 → 0.8.0

data/lib/secp256k1/musig.rb

@@ -132,6 +132,44 @@ module Secp256k1
       end
     end
 
+    # Generate a nonce pair deterministically using a non-repeating counter instead of session randomness.
+    # The caller must ensure that +counter+ never repeats for the same key pair.
+    # @param [Integer] counter A non-repeating counter(uint64).
+    # @param [String] private_key The private key for which the partial signature is generated, with hex format.
+    # @param [Secp256k1::MuSig::KeyAggContext] key_agg_ctx (Optional) The aggregated public key context.
+    # @param [String] msg (Optional) The message to be signed.
+    # @param [String] extra_in (Optional) The auxiliary input.
+    # @return [Array(String)] The array of secret nonce and public nonce with hex format.
+    # @raise [ArgumentError] If invalid arguments specified.
+    # @raise [Secp256k1::Error]
+    def generate_musig_nonce_counter(counter, private_key, key_agg_ctx: nil, msg: nil, extra_in: nil)
+      raise ArgumentError, "counter must be Integer." unless counter.is_a?(Integer)
+      raise ArgumentError, "counter must be between 0 and 2**64-1." if counter < 0 || counter > (2**64 - 1)
+      validate_string!("private_key", private_key, 32)
+      validate_string!("msg", msg, 32) if msg
+      validate_string!("extra_in", extra_in, 32) if extra_in
+      if key_agg_ctx
+        raise ArgumentError, "key_agg_ctx must be Secp256k1::MuSig::KeyAggContext." unless key_agg_ctx.is_a?(KeyAggContext)
+      end
+
+      with_context do |context|
+        keypair = [create_keypair(private_key)].pack('H*')
+        keypair_ptr = FFI::MemoryPointer.new(:uchar, 96).put_bytes(0, keypair)
+        pubnonce = FFI::MemoryPointer.new(:uchar, 132)
+        secnonce = FFI::MemoryPointer.new(:uchar, 132)
+        msg32 = msg ? FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(msg)) : nil
+        extra_input32 = extra_in ? FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(extra_in)) : nil
+        cache_ptr = key_agg_ctx ? key_agg_ctx.pointer : nil
+
+        raise Error, "arguments is invalid." unless secp256k1_musig_nonce_gen_counter(
+          context, secnonce, pubnonce, counter, keypair_ptr, msg32, cache_ptr, extra_input32) == 1
+
+        pub66 = FFI::MemoryPointer.new(:uchar, 66)
+        secp256k1_musig_pubnonce_serialize(context, pub66, pubnonce)
+        [secnonce.read_string(132).unpack1('H*'), pub66.read_string(66).unpack1('H*')]
+      end
+    end
+
     # Aggregates the nonces of all signers into a single nonce.
     # @param [Array] pub_nonces An array of public nonces sent by the signers.
     # @return [String] An aggregated public nonce.

data/lib/secp256k1/recovery.rb

@@ -68,5 +68,28 @@ module Secp256k1
         serialize_pubkey_internal(context, pubkey.read_string(64), compressed)
       end
     end
+
+    # Convert a recoverable signature into a normal DER-encoded ECDSA signature.
+    # @param [String] signature The recoverable signature with binary format(65 bytes), as accepted by {#recover}.
+    # @return [String] DER-encoded signature with binary format.
+    # @raise [Secp256k1::Error] If conversion failed.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def recoverable_signature_to_ecdsa(signature)
+      validate_string!("signature", signature, 65)
+      signature = hex2bin(signature)
+      rec = (signature[0].ord - 0x1b) & 3
+      raise ArgumentError, "rec must be between 0 and 3." if rec < 0 || rec > 3
+      with_context do |context|
+        recoverable = FFI::MemoryPointer.new(:uchar, 65)
+        input = FFI::MemoryPointer.new(:uchar, 64).put_bytes(0, signature[1..-1])
+        raise Error, 'secp256k1_ecdsa_recoverable_signature_parse_compact failed.' unless secp256k1_ecdsa_recoverable_signature_parse_compact(context, recoverable, input, rec) == 1
+        internal_signature = FFI::MemoryPointer.new(:uchar, 64)
+        raise Error, 'secp256k1_ecdsa_recoverable_signature_convert failed.' unless secp256k1_ecdsa_recoverable_signature_convert(context, internal_signature, recoverable) == 1
+        output = FFI::MemoryPointer.new(:uchar, 72)
+        output_len = FFI::MemoryPointer.new(:uint64).put_uint64(0, 72)
+        raise Error, 'secp256k1_ecdsa_signature_serialize_der failed.' unless secp256k1_ecdsa_signature_serialize_der(context, output, output_len, internal_signature) == 1
+        output.read_string(output_len.read_uint64)
+      end
+    end
   end
 end

data/lib/secp256k1/schnorrsig.rb

@@ -36,7 +36,44 @@ module Secp256k1
       end
     end
 
-    # Verify ecdsa signature.
+    # Magic bytes for secp256k1_schnorrsig_extraparams.
+    SCHNORRSIG_EXTRAPARAMS_MAGIC = [0xda, 0x6f, 0xb3, 0x8c].pack('C*').freeze
+
+    # Sign to a variable-length message using schnorr (BIP340 sign with custom parameters).
+    # @param [String] data The message being signed with binary format. Unlike {#sign_schnorr}, the length is arbitrary.
+    # @param [String] private_key a private key with hex format using sign.
+    # @param [String] aux_rand (Optional)The 32-byte extra entropy.
+    # @return [String] signature data with binary format(64 bytes).
+    # @raise [Secp256k1::Error] If signing failed.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def sign_schnorr_custom(data, private_key, aux_rand = nil)
+      raise ArgumentError, "data must be String." unless data.is_a?(String)
+      validate_string!("private_key", private_key, 32)
+      validate_string!("aux_rand", aux_rand, 32) if aux_rand
+      private_key = hex2bin(private_key)
+      data = hex2bin(data)
+      aux_rand = hex2bin(aux_rand) if aux_rand
+
+      with_context do |context|
+        keypair = [create_keypair(private_key)].pack('H*')
+        keypair = FFI::MemoryPointer.new(:uchar, 96).put_bytes(0, keypair)
+        signature = FFI::MemoryPointer.new(:uchar, 64)
+        msg = FFI::MemoryPointer.new(:uchar, [data.bytesize, 1].max).put_bytes(0, data)
+
+        # Build secp256k1_schnorrsig_extraparams: magic[4], noncefp(NULL=default BIP340), ndata(aux_rand or NULL).
+        ptr_size = FFI::Pointer.size
+        extraparams = FFI::MemoryPointer.new(:uchar, ptr_size * 3)
+        extraparams.put_bytes(0, SCHNORRSIG_EXTRAPARAMS_MAGIC)
+        extraparams.put_pointer(ptr_size, FFI::Pointer::NULL)
+        ndata = aux_rand ? FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, aux_rand) : FFI::Pointer::NULL
+        extraparams.put_pointer(ptr_size * 2, ndata)
+
+        raise Error, 'Failed to generate schnorr signature.' unless secp256k1_schnorrsig_sign_custom(context, signature, msg, data.bytesize, keypair, extraparams) == 1
+        signature.read_string(64)
+      end
+    end
+
+    # Verify schnorr signature.
     # @param [String] data The 32-byte message hash assumed to be signed.
     # @param [String] signature signature data with binary format
     # @param [String] pubkey a public key with hex format using verify.
@@ -44,6 +81,23 @@ module Secp256k1
     # @raise [ArgumentError] If invalid arguments specified.
     def verify_schnorr(data, signature, pubkey)
       validate_string!("data", data, 32)
+      verify_schnorr_internal(data, signature, pubkey)
+    end
+
+    # Verify a schnorr signature over a variable-length message (counterpart of {#sign_schnorr_custom}).
+    # @param [String] data The message assumed to be signed. The length is arbitrary.
+    # @param [String] signature signature data with binary format(64 bytes).
+    # @param [String] pubkey an x-only public key with hex format(32 bytes) using verify.
+    # @return [Boolean] verification result.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def verify_schnorr_custom(data, signature, pubkey)
+      raise ArgumentError, "data must be String." unless data.is_a?(String)
+      verify_schnorr_internal(data, signature, pubkey)
+    end
+
+    private
+
+    def verify_schnorr_internal(data, signature, pubkey)
       validate_string!("signature", signature, 64)
       validate_string!("pubkey", pubkey, 32)
       data = hex2bin(data)
@@ -54,8 +108,8 @@ module Secp256k1
         pubkey = [full_pubkey_from_xonly_pubkey(pubkey)].pack('H*')
         xonly_pubkey = FFI::MemoryPointer.new(:uchar, pubkey.bytesize).put_bytes(0, pubkey)
         signature = FFI::MemoryPointer.new(:uchar, signature.bytesize).put_bytes(0, signature)
-        msg32 = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, data)
-        result = secp256k1_schnorrsig_verify(context, signature, msg32, 32, xonly_pubkey)
+        msg = FFI::MemoryPointer.new(:uchar, [data.bytesize, 1].max).put_bytes(0, data)
+        result = secp256k1_schnorrsig_verify(context, signature, msg, data.bytesize, xonly_pubkey)
         result == 1
       end
     end

data/lib/secp256k1/silentpayments.rb

@@ -0,0 +1,319 @@
+module Secp256k1
+
+  # Silent Payments module (BIP-352).
+  # This module provides elliptic-curve operations required for sending and
+  # receiving Silent Payments. Note that this is not a full implementation of
+  # BIP-352; higher-level concepts like addresses, output script types or
+  # transactions must be handled by the caller.
+  # @example
+  #   include Secp256k1
+  #
+  #   # Sender side:
+  #   outputs = silentpayments_sender_create_outputs(
+  #     [[scan_pubkey, spend_pubkey]], outpoint_smallest, plain_seckeys: [seckey])
+  #
+  #   # Recipient side:
+  #   prevouts_summary = silentpayments_create_prevouts_summary(
+  #     outpoint_smallest, plain_pubkeys: [pubkey])
+  #   found = silentpayments_scan_outputs(
+  #     outputs, scan_key, prevouts_summary, spend_pubkey)
+  module SilentPayments
+
+    # Size of a serialized Silent Payments label.
+    SP_LABEL_SIZE = 33
+    # Size of an internal Silent Payments label object.
+    SP_LABEL_INTERNAL_SIZE = 68
+    # Size of a Silent Payments prevouts summary object.
+    SP_PREVOUTS_SUMMARY_SIZE = 101
+    # Maximum number of recipients sharing the same scan public key (BIP-352).
+    SP_RECIPIENT_GROUP_LIMIT = 2323
+
+    # Struct mirroring secp256k1_silentpayments_recipient.
+    class Recipient < FFI::Struct
+      layout :scan_pubkey, [:uchar, 64],
+             :spend_pubkey, [:uchar, 64],
+             :index, :size_t
+    end
+
+    # Struct mirroring secp256k1_silentpayments_found_output.
+    class FoundOutput < FFI::Struct
+      layout :output, [:uchar, 64],
+             :tweak, [:uchar, 32],
+             :found_with_label, :int,
+             :label, [:uchar, SP_LABEL_INTERNAL_SIZE]
+    end
+
+    # Whether the loaded libsecp256k1 supports the silentpayments module.
+    # The module is available in libsecp256k1 v0.8.0 or later.
+    # @return [Boolean]
+    def silentpayments_available?
+      C.silentpayments_available?
+    end
+
+    # Create Silent Payments outputs for recipient(s) (sender side).
+    # @param [Array] recipients An array of recipient's key pair. Each element is an array of
+    #   scan public key and (labeled) spend public key with hex format(33 bytes each).
+    # @param [String] outpoint_smallest The smallest outpoint lexicographically from the transaction inputs(36 bytes).
+    # @param [Array] plain_seckeys (Optional) An array of private keys of non-taproot inputs with hex format(32 bytes each).
+    # @param [Array] taproot_seckeys (Optional) An array of private keys of taproot inputs with hex format(32 bytes each).
+    # @return [Array] An array of x-only public keys(hex format) for the taproot outputs, ordered same as +recipients+.
+    # @raise [Secp256k1::Error] If creation failed.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def silentpayments_sender_create_outputs(recipients, outpoint_smallest, plain_seckeys: [], taproot_seckeys: [])
+      check_silentpayments_support!
+      raise ArgumentError, "recipients must be an Array." unless recipients.is_a?(Array)
+      raise ArgumentError, "recipients must not be empty." if recipients.empty?
+      plain_seckeys ||= []
+      taproot_seckeys ||= []
+      raise ArgumentError, "plain_seckeys must be an Array." unless plain_seckeys.is_a?(Array)
+      raise ArgumentError, "taproot_seckeys must be an Array." unless taproot_seckeys.is_a?(Array)
+      if plain_seckeys.empty? && taproot_seckeys.empty?
+        raise ArgumentError, "At least one private key(plain_seckeys or taproot_seckeys) is required."
+      end
+      validate_string!("outpoint_smallest", outpoint_smallest, 36)
+
+      with_context do |context|
+        recipient_structs = recipients.each_with_index.map do |recipient, i|
+          scan_pubkey, spend_pubkey = recipient
+          validate_string!("scan_pubkey", scan_pubkey, 33)
+          validate_string!("spend_pubkey", spend_pubkey, 33)
+          st = Recipient.new
+          st.pointer.put_bytes(0, parse_pubkey_internal(context, hex2bin(scan_pubkey)).read_string(64))
+          st.pointer.put_bytes(64, parse_pubkey_internal(context, hex2bin(spend_pubkey)).read_string(64))
+          st[:index] = i
+          st
+        end
+        recipients_ptr = FFI::MemoryPointer.new(:pointer, recipient_structs.length)
+        recipients_ptr.write_array_of_pointer(recipient_structs.map(&:pointer))
+
+        generated_outputs = Array.new(recipients.length) { FFI::MemoryPointer.new(:uchar, 64) }
+        generated_outputs_ptr = FFI::MemoryPointer.new(:pointer, generated_outputs.length)
+        generated_outputs_ptr.write_array_of_pointer(generated_outputs)
+
+        outpoint_ptr = FFI::MemoryPointer.new(:uchar, 36).put_bytes(0, hex2bin(outpoint_smallest))
+
+        keypairs = taproot_seckeys.map do |sk|
+          validate_string!("taproot_seckey", sk, 32)
+          seckey = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(sk))
+          keypair = FFI::MemoryPointer.new(:uchar, 96)
+          raise Error, "taproot_seckey is invalid." unless secp256k1_keypair_create(context, keypair, seckey) == 1
+          keypair
+        end
+        keypairs_ptr = if keypairs.empty?
+                         nil
+                       else
+                         FFI::MemoryPointer.new(:pointer, keypairs.length).write_array_of_pointer(keypairs)
+                       end
+
+        seckeys = plain_seckeys.map do |sk|
+          validate_string!("plain_seckey", sk, 32)
+          FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(sk))
+        end
+        seckeys_ptr = if seckeys.empty?
+                        nil
+                      else
+                        FFI::MemoryPointer.new(:pointer, seckeys.length).write_array_of_pointer(seckeys)
+                      end
+
+        result = secp256k1_silentpayments_sender_create_outputs(
+          context, generated_outputs_ptr, recipients_ptr, recipients.length, outpoint_ptr,
+          keypairs_ptr, keypairs.length, seckeys_ptr, seckeys.length)
+        raise Error, "secp256k1_silentpayments_sender_create_outputs failed." unless result == 1
+
+        generated_outputs.map { |output| serialize_xonly_pubkey_internal(context, output) }
+      end
+    end
+
+    # Create Silent Payments label tweak and label(recipient side).
+    # @param [String] scan_key The recipient's scan key with hex format(32 bytes).
+    # @param [Integer] m The integer for the m-th label (0 is used for change outputs).
+    # @return [Array(String)] An array of serialized label(33 bytes) and label tweak(32 bytes) with hex format.
+    # @raise [Secp256k1::Error] If creation failed.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def silentpayments_create_label(scan_key, m)
+      check_silentpayments_support!
+      validate_string!("scan_key", scan_key, 32)
+      raise ArgumentError, "m must be Integer." unless m.is_a?(Integer)
+      raise ArgumentError, "m must be between 0 and 2**32-1." if m < 0 || m > 0xffffffff
+
+      with_context do |context|
+        label = FFI::MemoryPointer.new(:uchar, SP_LABEL_INTERNAL_SIZE)
+        label_tweak = FFI::MemoryPointer.new(:uchar, 32)
+        scan_key_ptr = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(scan_key))
+        result = secp256k1_silentpayments_recipient_label_create(context, label, label_tweak, scan_key_ptr, m)
+        raise Error, "secp256k1_silentpayments_recipient_label_create failed." unless result == 1
+        out33 = FFI::MemoryPointer.new(:uchar, SP_LABEL_SIZE)
+        secp256k1_silentpayments_recipient_label_serialize(context, out33, label)
+        [out33.read_string(SP_LABEL_SIZE).unpack1('H*'), label_tweak.read_string(32).unpack1('H*')]
+      end
+    end
+
+    # Create Silent Payments labeled spend public key(recipient side).
+    # @param [String] spend_pubkey The recipient's unlabeled spend public key with hex format(33 bytes).
+    # @param [String] label The serialized label with hex format(33 bytes).
+    # @return [String] The labeled spend public key with hex format(33 bytes).
+    # @raise [Secp256k1::Error] If creation failed.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def silentpayments_create_labeled_spend_pubkey(spend_pubkey, label)
+      check_silentpayments_support!
+      validate_string!("spend_pubkey", spend_pubkey, 33)
+      validate_string!("label", label, SP_LABEL_SIZE)
+
+      with_context do |context|
+        spend_pubkey_ptr = parse_pubkey_internal(context, hex2bin(spend_pubkey))
+        label_ptr = parse_label_internal(context, hex2bin(label))
+        labeled = FFI::MemoryPointer.new(:uchar, 64)
+        result = secp256k1_silentpayments_recipient_create_labeled_spend_pubkey(context, labeled, spend_pubkey_ptr, label_ptr)
+        raise Error, "secp256k1_silentpayments_recipient_create_labeled_spend_pubkey failed." unless result == 1
+        serialize_pubkey_internal(context, labeled, true)
+      end
+    end
+
+    # Compute Silent Payments prevouts summary from prevout public keys and transaction inputs(recipient side).
+    # @param [String] outpoint_smallest The smallest outpoint lexicographically from the transaction inputs(36 bytes).
+    # @param [Array] plain_pubkeys (Optional) An array of public keys of non-taproot inputs with hex format(33 bytes each).
+    # @param [Array] xonly_pubkeys (Optional) An array of x-only public keys of taproot inputs with hex format(32 bytes each).
+    # @return [String] The prevouts summary data with hex format(101 bytes).
+    #   Note that this is an opaque representation which is not guaranteed to be
+    #   portable between different platforms or library versions.
+    # @raise [Secp256k1::Error] If the transaction is not a Silent Payments transaction.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def silentpayments_create_prevouts_summary(outpoint_smallest, plain_pubkeys: [], xonly_pubkeys: [])
+      check_silentpayments_support!
+      plain_pubkeys ||= []
+      xonly_pubkeys ||= []
+      raise ArgumentError, "plain_pubkeys must be an Array." unless plain_pubkeys.is_a?(Array)
+      raise ArgumentError, "xonly_pubkeys must be an Array." unless xonly_pubkeys.is_a?(Array)
+      if plain_pubkeys.empty? && xonly_pubkeys.empty?
+        raise ArgumentError, "At least one public key(plain_pubkeys or xonly_pubkeys) is required."
+      end
+      validate_string!("outpoint_smallest", outpoint_smallest, 36)
+
+      with_context do |context|
+        xonly_ptrs = xonly_pubkeys.map do |pubkey|
+          validate_string!("xonly_pubkey", pubkey, 32)
+          parse_xonly_pubkey_internal(context, hex2bin(pubkey))
+        end
+        plain_ptrs = plain_pubkeys.map do |pubkey|
+          validate_string!("plain_pubkey", pubkey, 33)
+          parse_pubkey_internal(context, hex2bin(pubkey))
+        end
+        xonly_arr = if xonly_ptrs.empty?
+                      nil
+                    else
+                      FFI::MemoryPointer.new(:pointer, xonly_ptrs.length).write_array_of_pointer(xonly_ptrs)
+                    end
+        plain_arr = if plain_ptrs.empty?
+                      nil
+                    else
+                      FFI::MemoryPointer.new(:pointer, plain_ptrs.length).write_array_of_pointer(plain_ptrs)
+                    end
+        outpoint_ptr = FFI::MemoryPointer.new(:uchar, 36).put_bytes(0, hex2bin(outpoint_smallest))
+        prevouts_summary = FFI::MemoryPointer.new(:uchar, SP_PREVOUTS_SUMMARY_SIZE)
+        result = secp256k1_silentpayments_recipient_prevouts_summary_create(
+          context, prevouts_summary, outpoint_ptr, xonly_arr, xonly_ptrs.length, plain_arr, plain_ptrs.length)
+        raise Error, "secp256k1_silentpayments_recipient_prevouts_summary_create failed." unless result == 1
+        prevouts_summary.read_string(SP_PREVOUTS_SUMMARY_SIZE).unpack1('H*')
+      end
+    end
+
+    # Scan for Silent Payments transaction outputs(recipient side).
+    # @param [Array] tx_outputs An array of the transaction's x-only public key outputs with hex format(32 bytes each),
+    #   in their original transaction (vout) order.
+    # @param [String] scan_key The recipient's scan key with hex format(32 bytes).
+    # @param [String] prevouts_summary The prevouts summary data created by #silentpayments_create_prevouts_summary
+    #   with hex format(101 bytes).
+    # @param [String] spend_pubkey The recipient's unlabeled spend public key with hex format(33 bytes).
+    # @param [Hash] labels (Optional) The recipient's label cache. A hash whose key is a serialized label(33 bytes)
+    #   and whose value is the corresponding label tweak(32 bytes), both with hex format.
+    #   Can be created with #silentpayments_create_label.
+    # @return [Array] An array of found outputs. Each element is a hash with the following keys:
+    #   - :output x-only public key of the found output with hex format(32 bytes).
+    #   - :tweak The 32-byte tweak needed to spend the output with hex format.
+    #   - :label The serialized label(33 bytes with hex format) if the output was sent to a labeled address, otherwise nil.
+    # @raise [Secp256k1::Error] If the transaction is not a Silent Payments transaction or arguments are invalid.
+    # @raise [ArgumentError] If invalid arguments specified.
+    def silentpayments_scan_outputs(tx_outputs, scan_key, prevouts_summary, spend_pubkey, labels: nil)
+      check_silentpayments_support!
+      raise ArgumentError, "tx_outputs must be an Array." unless tx_outputs.is_a?(Array)
+      raise ArgumentError, "tx_outputs must not be empty." if tx_outputs.empty?
+      validate_string!("scan_key", scan_key, 32)
+      validate_string!("prevouts_summary", prevouts_summary, SP_PREVOUTS_SUMMARY_SIZE)
+      validate_string!("spend_pubkey", spend_pubkey, 33)
+      raise ArgumentError, "labels must be a Hash." if labels && !labels.is_a?(Hash)
+
+      with_context do |context|
+        output_ptrs = tx_outputs.map do |output|
+          validate_string!("tx_output", output, 32)
+          parse_xonly_pubkey_internal(context, hex2bin(output))
+        end
+        tx_outputs_ptr = FFI::MemoryPointer.new(:pointer, output_ptrs.length).write_array_of_pointer(output_ptrs)
+
+        found_outputs = Array.new(tx_outputs.length) { FoundOutput.new }
+        found_outputs_ptr = FFI::MemoryPointer.new(:pointer, found_outputs.length)
+        found_outputs_ptr.write_array_of_pointer(found_outputs.map(&:pointer))
+        n_found = FFI::MemoryPointer.new(:uint32)
+
+        scan_key_ptr = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(scan_key))
+        prevouts_summary_ptr = FFI::MemoryPointer.new(:uchar, SP_PREVOUTS_SUMMARY_SIZE).
+          put_bytes(0, hex2bin(prevouts_summary))
+        spend_pubkey_ptr = parse_pubkey_internal(context, hex2bin(spend_pubkey))
+
+        label_lookup = nil
+        if labels
+          # Keep tweak pointers referenced in this hash so they remain valid while scanning.
+          tweak_cache = {}
+          labels.each do |label, tweak|
+            validate_string!("label", label, SP_LABEL_SIZE)
+            validate_string!("label_tweak", tweak, 32)
+            tweak_cache[hex2bin(label)] = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(tweak))
+          end
+          label_lookup = FFI::Function.new(:pointer, [:pointer, :pointer]) do |label33, _|
+            tweak_cache[label33.read_string(SP_LABEL_SIZE)] || FFI::Pointer::NULL
+          end
+        end
+
+        result = secp256k1_silentpayments_recipient_scan_outputs(
+          context, found_outputs_ptr, n_found, tx_outputs_ptr, tx_outputs.length,
+          scan_key_ptr, prevouts_summary_ptr, spend_pubkey_ptr, label_lookup, nil)
+        raise Error, "secp256k1_silentpayments_recipient_scan_outputs failed." unless result == 1
+
+        Array.new(n_found.read_uint32) do |i|
+          found = found_outputs[i]
+          label = if found[:found_with_label] != 0
+                    out33 = FFI::MemoryPointer.new(:uchar, SP_LABEL_SIZE)
+                    secp256k1_silentpayments_recipient_label_serialize(
+                      context, out33, found.pointer + FoundOutput.offset_of(:label))
+                    out33.read_string(SP_LABEL_SIZE).unpack1('H*')
+                  end
+          {
+            output: serialize_xonly_pubkey_internal(context, found.pointer),
+            tweak: found.pointer.get_bytes(FoundOutput.offset_of(:tweak), 32).unpack1('H*'),
+            label: label
+          }
+        end
+      end
+    end
+
+    private
+
+    # @raise [Secp256k1::Error] If the loaded libsecp256k1 does not support the silentpayments module.
+    def check_silentpayments_support!
+      unless C.silentpayments_available?
+        raise Error, "The loaded libsecp256k1 does not support the silentpayments module. libsecp256k1 v0.8.0 or later is required."
+      end
+    end
+
+    # Parse a serialized label into an internal label pointer.
+    # @param [FFI::Pointer] context secp256k1 context.
+    # @param [String] label serialized label with binary format(33 bytes).
+    # @return [FFI::Pointer] internal label pointer(68 bytes).
+    # @raise [Secp256k1::Error] If the label is invalid.
+    def parse_label_internal(context, label)
+      label_ptr = FFI::MemoryPointer.new(:uchar, SP_LABEL_SIZE).put_bytes(0, label)
+      internal = FFI::MemoryPointer.new(:uchar, SP_LABEL_INTERNAL_SIZE)
+      raise Error, 'An invalid label was specified.' unless secp256k1_silentpayments_recipient_label_parse(context, internal, label_ptr) == 1
+      internal
+    end
+  end
+end

data/lib/secp256k1/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Secp256k1
-  VERSION = "0.2.0"
+  VERSION = "0.8.0"
 end

data/lib/secp256k1.rb

@@ -3,10 +3,13 @@
 require 'securerandom'
 require_relative "secp256k1/version"
 require_relative 'secp256k1/c'
+require_relative 'secp256k1/key'
+require_relative 'secp256k1/ecdh'
 require_relative 'secp256k1/recovery'
 require_relative 'secp256k1/ellswift'
 require_relative 'secp256k1/schnorrsig'
 require_relative 'secp256k1/musig'
+require_relative 'secp256k1/silentpayments'
 
 # Binding for secp256k1 (https://github.com/bitcoin-core/secp256k1/)
 # @example
@@ -28,10 +31,13 @@ module Secp256k1
   class Error < StandardError; end
 
   include C
+  include Key
+  include ECDH
   include Recover
   include SchnorrSig
   include EllSwift
   include MuSig
+  include SilentPayments
 
   FLAGS_TYPE_MASK = ((1 << 8) - 1)
   FLAGS_TYPE_CONTEXT = (1 << 0)
@@ -84,8 +90,8 @@ module Secp256k1
         private_key = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, SecureRandom.random_bytes(32))
         ret = secp256k1_ec_seckey_verify(context, private_key)
       end
-      private_key =  private_key.read_string(32).unpack1('H*')
-      [private_key , generate_pubkey_in_context(context,  private_key, compressed: compressed) ]
+      private_key = private_key.read_string(32)
+      [private_key.unpack1('H*'), generate_pubkey_in_context(context, private_key, compressed: compressed)]
     end
   end
 
@@ -223,6 +229,64 @@ module Secp256k1
     end
   end
 
+  # Convert a DER-encoded ECDSA signature into compact(64 bytes) format.
+  # @param [String] signature DER-encoded signature with binary format.
+  # @return [String] compact signature(64 bytes) with binary format.
+  # @raise [Secp256k1::Error] If the signature could not be parsed.
+  # @raise [ArgumentError] If invalid arguments specified.
+  def ecdsa_signature_to_compact(signature)
+    raise ArgumentError, "signature must be String." unless signature.is_a?(String)
+    signature = hex2bin(signature)
+    with_context do |context|
+      sig_ptr = FFI::MemoryPointer.new(:uchar, signature.bytesize).put_bytes(0, signature)
+      internal_signature = FFI::MemoryPointer.new(:uchar, 64)
+      raise Error, 'secp256k1_ecdsa_signature_parse_der failed.' unless secp256k1_ecdsa_signature_parse_der(context, internal_signature, sig_ptr, signature.bytesize) == 1
+      output = FFI::MemoryPointer.new(:uchar, 64)
+      secp256k1_ecdsa_signature_serialize_compact(context, output, internal_signature)
+      output.read_string(64)
+    end
+  end
+
+  # Convert a compact(64 bytes) ECDSA signature into DER-encoded format.
+  # @param [String] signature compact signature(64 bytes) with binary format.
+  # @return [String] DER-encoded signature with binary format.
+  # @raise [Secp256k1::Error] If the signature could not be parsed.
+  # @raise [ArgumentError] If invalid arguments specified.
+  def ecdsa_signature_from_compact(signature)
+    validate_string!("signature", signature, 64)
+    signature = hex2bin(signature)
+    with_context do |context|
+      sig_ptr = FFI::MemoryPointer.new(:uchar, 64).put_bytes(0, signature)
+      internal_signature = FFI::MemoryPointer.new(:uchar, 64)
+      raise Error, 'secp256k1_ecdsa_signature_parse_compact failed.' unless secp256k1_ecdsa_signature_parse_compact(context, internal_signature, sig_ptr) == 1
+      output = FFI::MemoryPointer.new(:uchar, 72)
+      output_len = FFI::MemoryPointer.new(:uint64).put_uint64(0, 72)
+      raise Error, 'secp256k1_ecdsa_signature_serialize_der failed.' unless secp256k1_ecdsa_signature_serialize_der(context, output, output_len, internal_signature) == 1
+      output.read_string(output_len.read_uint64)
+    end
+  end
+
+  # Compute a tagged hash as defined in BIP-340: SHA256(SHA256(tag) || SHA256(tag) || msg).
+  # @param [String] tag the tag with binary format.
+  # @param [String] msg the message with binary format.
+  # @return [String] 32-byte tagged hash with hex format.
+  # @raise [Secp256k1::Error] If the hash could not be computed.
+  # @raise [ArgumentError] If invalid arguments specified.
+  def tagged_sha256(tag, msg)
+    raise ArgumentError, "tag must be String." unless tag.is_a?(String)
+    raise ArgumentError, "msg must be String." unless msg.is_a?(String)
+    tag = hex2bin(tag)
+    msg = hex2bin(msg)
+    with_context do |context|
+      hash32 = FFI::MemoryPointer.new(:uchar, 32)
+      # The library requires non-NULL pointers even for zero-length input, so allocate at least 1 byte.
+      tag_ptr = FFI::MemoryPointer.new(:uchar, [tag.bytesize, 1].max).put_bytes(0, tag)
+      msg_ptr = FFI::MemoryPointer.new(:uchar, [msg.bytesize, 1].max).put_bytes(0, msg)
+      raise Error, 'secp256k1_tagged_sha256 failed.' unless secp256k1_tagged_sha256(context, hash32, tag_ptr, tag.bytesize, msg_ptr, msg.bytesize) == 1
+      hash32.read_string(32).unpack1('H*')
+    end
+  end
+
   private
 
   # Calculate full public key(64 bytes) from public key(32 bytes).
@@ -239,9 +303,34 @@ module Secp256k1
     end
   end
 
+  # Parse a serialized public key into an internal 64-byte pubkey pointer.
+  # @param [FFI::Pointer] context secp256k1 context.
+  # @param [String] pubkey serialized public key with binary format.
+  # @return [FFI::Pointer] internal pubkey pointer(64 bytes).
+  # @raise [Secp256k1::Error] If the public key is invalid.
+  def parse_pubkey_internal(context, pubkey)
+    pubkey_ptr = FFI::MemoryPointer.new(:uchar, pubkey.bytesize).put_bytes(0, pubkey)
+    internal_pubkey = FFI::MemoryPointer.new(:uchar, 64)
+    raise Error, 'An invalid public key was specified.' unless secp256k1_ec_pubkey_parse(context, internal_pubkey, pubkey_ptr, pubkey.bytesize) == 1
+    internal_pubkey
+  end
+
+  # Serialize an internal x-only public key pointer(64 bytes) to 32-byte hex.
+  # @param [FFI::Pointer] context secp256k1 context.
+  # @param [FFI::Pointer] xonly_input internal x-only pubkey pointer(64 bytes).
+  # @return [String] x-only public key with hex format(32 bytes).
+  def serialize_xonly_pubkey_internal(context, xonly_input)
+    output = FFI::MemoryPointer.new(:uchar, X_ONLY_PUBKEY_SIZE)
+    secp256k1_xonly_pubkey_serialize(context, output, xonly_input)
+    output.read_string(X_ONLY_PUBKEY_SIZE).unpack1('H*')
+  end
+
+  # Generate public key from +private_key+ using given +context+.
+  # +private_key+ must be a 32-byte binary string, not hex, to avoid a second
+  # hex conversion corrupting binary keys that happen to look like hex strings.
   def generate_pubkey_in_context(context, private_key, compressed: true)
     internal_pubkey = FFI::MemoryPointer.new(:uchar, 64)
-    priv_ptr = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, hex2bin(private_key))
+    priv_ptr = FFI::MemoryPointer.new(:uchar, 32).put_bytes(0, private_key)
     result = secp256k1_ec_pubkey_create(context, internal_pubkey, priv_ptr)
     raise 'error creating pubkey' unless result
     serialize_pubkey_internal(context, internal_pubkey, compressed)