algosdk 3.6.0 → 3.7.0-beta.1

package/src/logicsig.ts

@@ -1,5 +1,9 @@
 import * as nacl from './nacl/naclWrappers.js';
-import { Address, isValidAddress } from './encoding/address.js';
+import {
+  Address,
+  addressFromPQSig,
+  isValidAddress,
+} from './encoding/address.js';
 import * as encoding from './encoding/encoding.js';
 import {
   NamedMapSchema,
@@ -21,7 +25,12 @@ import {
   encodedMultiSigToEncodingData,
   encodedMultiSigFromEncodingData,
   ENCODED_MULTISIG_SCHEMA,
+  EncodedPQSig,
+  ENCODED_PQSIG_SCHEMA,
+  encodedPQSigToEncodingData,
+  encodedPQSigFromEncodingData,
 } from './types/transactions/encoded.js';
+import type { DelegatedLsigSigner, ProgramDataSigner } from './signer.js';
 
 // base64regex is the regex to test for base64 strings
 const base64regex =
@@ -59,8 +68,9 @@ export function sanityCheckProgram(program: Uint8Array) {
   }
 }
 
-const programTag = new TextEncoder().encode('Program');
-const multisigProgramTag = new TextEncoder().encode('MsigProgram');
+export const PROGRAM_TAG = new TextEncoder().encode('Program');
+export const PQ_PROGRAM_TAG = new TextEncoder().encode('PQProgram');
+export const MSIG_PROGRAM_TAG = new TextEncoder().encode('MsigProgram');
 
 /**
  LogicSig implementation
@@ -90,6 +100,10 @@ export class LogicSig implements encoding.Encodable {
         key: 'lmsig',
         valueSchema: new OptionalSchema(ENCODED_MULTISIG_SCHEMA),
       },
+      {
+        key: 'pqsig',
+        valueSchema: new OptionalSchema(ENCODED_PQSIG_SCHEMA),
+      },
     ])
   );
 
@@ -98,6 +112,7 @@ export class LogicSig implements encoding.Encodable {
   sig?: Uint8Array;
   msig?: EncodedMultisig;
   lmsig?: EncodedMultisig;
+  pqsig?: EncodedPQSig;
 
   constructor(program: Uint8Array, programArgs?: Array<Uint8Array> | null) {
     if (
@@ -119,6 +134,7 @@ export class LogicSig implements encoding.Encodable {
     this.sig = undefined;
     this.msig = undefined;
     this.lmsig = undefined;
+    this.pqsig = undefined;
   }
 
   // eslint-disable-next-line class-methods-use-this
@@ -138,6 +154,9 @@ export class LogicSig implements encoding.Encodable {
     if (this.lmsig) {
       data.set('lmsig', encodedMultiSigToEncodingData(this.lmsig));
     }
+    if (this.pqsig) {
+      data.set('pqsig', encodedPQSigToEncodingData(this.pqsig));
+    }
     return data;
   }
 
@@ -153,15 +172,23 @@ export class LogicSig implements encoding.Encodable {
     if (data.get('lmsig')) {
       lsig.lmsig = encodedMultiSigFromEncodingData(data.get('lmsig'));
     }
+    if (data.get('pqsig')) {
+      lsig.pqsig = encodedPQSigFromEncodingData(data.get('pqsig'));
+    }
     return lsig;
   }
 
   /**
+   * @deprecated This function does not perform full verification and should not be fully trusted on its own.
+   * For example, it does not evaluate programs and does not have the ability to validate PQ signatures.
+   *
    * Performs signature verification
    * @param publicKey - Verification key (derived from sender address or escrow address)
    */
   verify(publicKey: Uint8Array) {
-    const sigCount = [this.sig, this.msig, this.lmsig].filter(Boolean).length;
+    const sigCount = [this.sig, this.msig, this.lmsig, this.pqsig].filter(
+      Boolean
+    ).length;
     if (sigCount > 1) {
       return false;
     }
@@ -172,13 +199,21 @@ export class LogicSig implements encoding.Encodable {
       return false;
     }
 
-    const toBeSigned = utils.concatArrays(programTag, this.logic);
+    const toBeSigned = utils.concatArrays(PROGRAM_TAG, this.logic);
 
-    if (!this.sig && !this.msig && !this.lmsig) {
+    if (!this.sig && !this.msig && !this.lmsig && !this.pqsig) {
       const hash = nacl.genericHash(toBeSigned);
       return utils.arrayEqual(hash, publicKey);
     }
 
+    if (this.pqsig) {
+      // This function has no way to validate a post-quantum signature, so it
+      // cannot report success here. Callers that need to sign a transaction
+      // with a PQ delegated LogicSig should go through
+      // signLogicSigTransactionObject, which skips this check.
+      return false;
+    }
+
     if (this.sig) {
       return nacl.verify(toBeSigned, this.sig, publicKey);
     }
@@ -190,7 +225,7 @@ export class LogicSig implements encoding.Encodable {
         pks: this.lmsig.subsig.map((subsig) => subsig.pk),
       });
       const lmsigProgram = utils.concatArrays(
-        multisigProgramTag,
+        MSIG_PROGRAM_TAG,
         multisigAddr.publicKey,
         this.logic
       );
@@ -209,12 +244,14 @@ export class LogicSig implements encoding.Encodable {
    * @returns String representation of the address
    */
   address(): Address {
-    const toBeSigned = utils.concatArrays(programTag, this.logic);
+    const toBeSigned = utils.concatArrays(PROGRAM_TAG, this.logic);
     const hash = nacl.genericHash(toBeSigned);
     return new Address(Uint8Array.from(hash));
   }
 
   /**
+   * @deprecated Use `signWithSigner` instead
+   *
    * Creates signature (if no msig provided) or multi signature otherwise
    * @param secretKey - Secret key to sign with
    * @param msig - Multisig account as \{version, threshold, addrs\}
@@ -237,6 +274,81 @@ export class LogicSig implements encoding.Encodable {
   }
 
   /**
+   * Signs this LogicSig for delegation using the given signer.
+   *
+   * @param signer - The signer to delegate to
+   * @param msig - Optional multisig account the signer is a subsigner of
+   * @returns The address the signer signed as. When `msig` is omitted this is
+   *   the delegating account. When `msig` is given it is the individual
+   *   subsigner, not the multisig, so the delegating account is
+   *   `multisigAddress(msig)`. Either way it is an authorizing address, which
+   *   is not necessarily the address a signer sends transactions from.
+   *
+   * Re-signing an already-signed LogicSig is allowed, and replaces the previous
+   * delegation signature. At most one of `sig`, `msig`, `lmsig` and `pqsig` may
+   * be set, so any signature left over from an earlier call is cleared.
+   */
+  async signWithSigner(
+    signer: DelegatedLsigSigner,
+    msig?: MultisigMetadata
+  ): Promise<Address> {
+    const sigResult = await signer(this, msig);
+    if (msig == null) {
+      if ('pqsig' in sigResult && sigResult.pqsig) {
+        this.clearSignatures();
+        this.pqsig = sigResult.pqsig;
+        return sigResult.address;
+      }
+
+      if (!('sig' in sigResult) || !sigResult.sig) {
+        throw Error(
+          'Expected DelegatedLsigSigner to return sig or pqsig, but both are undefined. If signing for an msig, be sure to pass the msig argument'
+        );
+      }
+      this.clearSignatures();
+      this.sig = sigResult.sig;
+    } else {
+      if (!('lmsig' in sigResult) || !sigResult.lmsig) {
+        throw Error(
+          'Expected DelegatedLsigSigner to return lmsig, but lmsig is undefined. If signing for a single account, do not pass msig argument'
+        );
+      }
+      const { lmsig } = sigResult;
+      const expectedPks = pksFromAddresses(msig.addrs);
+      if (
+        lmsig.v !== msig.version ||
+        lmsig.thr !== msig.threshold ||
+        lmsig.subsig.length !== expectedPks.length ||
+        !lmsig.subsig.every((subsig, i) =>
+          utils.arrayEqual(subsig.pk, expectedPks[i])
+        )
+      ) {
+        throw Error(
+          'DelegatedLsigSigner returned an lmsig whose version, threshold or public keys do not match the requested multisig'
+        );
+      }
+
+      this.clearSignatures();
+      this.lmsig = sigResult.lmsig;
+    }
+
+    return sigResult.address;
+  }
+
+  /**
+   * Removes every delegation signature from this LogicSig, so that exactly one
+   * of them can be set afterwards.
+   */
+  private clearSignatures() {
+    this.sig = undefined;
+    this.msig = undefined;
+    this.lmsig = undefined;
+    this.pqsig = undefined;
+  }
+
+  /**
+   * @deprecated Use `appendToMultisigWithSigner` instead
+   *
    * Appends a signature to multi signature
    * @param secretKey - Secret key to sign with
    */
@@ -248,12 +360,71 @@ export class LogicSig implements encoding.Encodable {
     this.lmsig.subsig[index].s = sig;
   }
 
+  async appendToMultisigWithSigner(signer: DelegatedLsigSigner) {
+    if (this.lmsig === undefined) {
+      throw new Error('no multisig present');
+    }
+
+    const sigResult = await signer(this, {
+      version: this.lmsig.v,
+      threshold: this.lmsig.thr,
+      addrs: this.lmsig.subsig.map((s) => new Address(s.pk)),
+    });
+
+    if (!('lmsig' in sigResult) || !sigResult.lmsig) {
+      throw Error(
+        'Expected DelegatedLsigSigner to return lmsig, but lmsig is undefined'
+      );
+    }
+    if (
+      sigResult.lmsig.v !== this.lmsig.v ||
+      sigResult.lmsig.thr !== this.lmsig.thr
+    ) {
+      throw Error(
+        'DelegatedLsigSigner returned an lmsig whose version or threshold does not match the current msig'
+      );
+    }
+
+    let signaturesReturned = false;
+    for (const subsig of sigResult.lmsig.subsig) {
+      if (subsig.s) {
+        signaturesReturned = true;
+        const thisSubsig = this.lmsig.subsig.find((s) =>
+          utils.arrayEqual(s.pk, subsig.pk)
+        );
+        if (thisSubsig === undefined) {
+          throw Error(
+            `DelegatedLsigSigner returned a signature for ${new Address(subsig.pk)} but this pk is not in the current msig`
+          );
+        }
+        // Never let the signer silently replace a signature already collected
+        // from another member.
+        if (thisSubsig.s && !utils.arrayEqual(thisSubsig.s, subsig.s)) {
+          throw Error(
+            `DelegatedLsigSigner returned a signature for ${new Address(subsig.pk)} that conflicts with the signature already collected for it`
+          );
+        }
+        thisSubsig.s = subsig.s;
+      }
+    }
+
+    if (!signaturesReturned) {
+      throw Error('DelegatedLsigSigner returned an lmsig with no signatures');
+    }
+  }
+
+  /**
+   * @deprecated Use `signWithSigner` followed by `.sig` instead
+   */
   signProgram(secretKey: Uint8Array) {
-    const toBeSigned = utils.concatArrays(programTag, this.logic);
+    const toBeSigned = utils.concatArrays(PROGRAM_TAG, this.logic);
     const sig = nacl.sign(toBeSigned, secretKey);
     return sig;
   }
 
+  /**
+   * @deprecated Use `signWithSigner` followed by `.sig` instead
+   */
   signProgramMultisig(secretKey: Uint8Array, msig: EncodedMultisig) {
     const multisigAddr = addressFromMultisigPreImg({
       version: msig.v,
@@ -261,7 +432,7 @@ export class LogicSig implements encoding.Encodable {
       pks: msig.subsig.map((subsig) => subsig.pk),
     });
     const toBeSigned = utils.concatArrays(
-      multisigProgramTag,
+      MSIG_PROGRAM_TAG,
       multisigAddr.publicKey,
       this.logic
     );
@@ -269,6 +440,9 @@ export class LogicSig implements encoding.Encodable {
     return sig;
   }
 
+  /**
+   * @deprecated Use `signWithSigner` followed by `.sig` instead
+   */
   singleSignMultisig(
     secretKey: Uint8Array,
     msig: EncodedMultisig
@@ -296,6 +470,17 @@ export class LogicSig implements encoding.Encodable {
   static fromByte(encoded: ArrayLike<any>): LogicSig {
     return encoding.decodeMsgpack(encoded, LogicSig);
   }
+
+  /**
+   * Signs arbitrary data for use with the `ed25519verify` opcode from within
+   * this LogicSig's program.
+   *
+   * @param signer - The signer to sign the data with
+   * @param data - The data to sign
+   */
+  async signDataWithSigner(signer: ProgramDataSigner, data: Uint8Array) {
+    return signer(data, this);
+  }
 }
 
 /**
@@ -379,10 +564,18 @@ export class LogicSigAccount implements encoding.Encodable {
    * To verify the delegation signature, use `verify`.
    */
   isDelegated() {
-    return !!(this.lsig.sig || this.lsig.msig || this.lsig.lmsig);
+    return !!(
+      this.lsig.sig ||
+      this.lsig.msig ||
+      this.lsig.lmsig ||
+      this.lsig.pqsig
+    );
   }
 
   /**
+   * @deprecated This function does not perform full verification and should not be fully trusted on its own.
+   * For example, it does not evaluate programs and does not have the ability to validate PQ signatures.
+   *
    * Verifies this LogicSig's program and signatures.
    * @returns true if and only if the LogicSig program and signatures are valid.
    */
@@ -401,15 +594,31 @@ export class LogicSigAccount implements encoding.Encodable {
    *  escrow address that is the hash of the LogicSig's program code.
    */
   address(): Address {
-    const sigCount = [this.lsig.sig, this.lsig.msig, this.lsig.lmsig].filter(
-      Boolean
-    ).length;
+    const sigCount = [
+      this.lsig.sig,
+      this.lsig.msig,
+      this.lsig.lmsig,
+      this.lsig.pqsig,
+    ].filter(Boolean).length;
     if (sigCount > 1) {
       throw new Error(
-        'LogicSig has too many signatures. At most one of sig, msig, or lmsig may be present'
+        'LogicSig has too many signatures. At most one of sig, msig, lmsig, or pqsig may be present'
       );
     }
 
+    if (this.lsig.pqsig) {
+      // A PQ signature carries the scheme, salt and public key of the
+      // delegating account, so derive the address rather than trusting
+      // `sigkey`. Also throws if the signature is not self-consistent.
+      const derived = addressFromPQSig(this.lsig.pqsig);
+      if (this.sigkey && !utils.arrayEqual(this.sigkey, derived.publicKey)) {
+        throw new Error(
+          `Signing key for delegated account does not match the PQ signature. The signature authorizes ${derived}, but sigkey is ${new Address(this.sigkey)}`
+        );
+      }
+      return derived;
+    }
+
     if (this.lsig.sig) {
       if (!this.sigkey) {
         throw new Error('Signing key for delegated account is missing');
@@ -431,6 +640,8 @@ export class LogicSigAccount implements encoding.Encodable {
   }
 
   /**
+   * @deprecated Use `signMultisigWithSigner` instead
+   *
    * Turns this LogicSigAccount into a delegated LogicSig. This type of LogicSig
    * has the authority to sign transactions on behalf of another account, called
    * the delegating account. Use this function if the delegating account is a
@@ -445,7 +656,16 @@ export class LogicSigAccount implements encoding.Encodable {
     this.lsig.sign(secretKey, msig);
   }
 
+  async signMultisigWithSigner(
+    msig: MultisigMetadata,
+    signer: DelegatedLsigSigner
+  ) {
+    await this.lsig.signWithSigner(signer, msig);
+  }
+
   /**
+   * @deprecated Use appendToMultisigWithSigner
+   *
    * Adds an additional signature from a member of the delegating multisig
    * account.
    *
@@ -456,7 +676,13 @@ export class LogicSigAccount implements encoding.Encodable {
     this.lsig.appendToMultisig(secretKey);
   }
 
+  async appendToMultisigWithSigner(signer: DelegatedLsigSigner) {
+    await this.lsig.appendToMultisigWithSigner(signer);
+  }
+
   /**
+   * @deprecated Use `signWithSigner` instead
+   *
    * Turns this LogicSigAccount into a delegated LogicSig. This type of LogicSig
    * has the authority to sign transactions on behalf of another account, called
    * the delegating account. If the delegating account is a multisig account,
@@ -468,6 +694,22 @@ export class LogicSigAccount implements encoding.Encodable {
     this.lsig.sign(secretKey);
     this.sigkey = nacl.keyPairFromSecretKey(secretKey).publicKey;
   }
+
+  /**
+   * Turns this LogicSigAccount into a delegated LogicSig, signed by the given
+   * signer. If the delegating account is a multisig account, use
+   * `signMultisigWithSigner` instead.
+   *
+   * @param signer - The signer of the delegating account.
+   */
+  async signWithSigner(signer: DelegatedLsigSigner) {
+    // Record the address the signer reports rather than any sending address it
+    // may advertise: the latter is the address the signer sends transactions
+    // from, which for a rekeyed account is not the account that authorizes
+    // this delegation.
+    const delegatingAddress = await this.lsig.signWithSigner(signer);
+    this.sigkey = delegatingAddress.publicKey;
+  }
 }
 
 /**
@@ -478,7 +720,7 @@ export function logicSigFromByte(encoded: Uint8Array): LogicSig {
   return encoding.decodeMsgpack(encoded, LogicSig);
 }
 
-const SIGN_PROGRAM_DATA_PREFIX = new TextEncoder().encode('ProgData');
+export const SIGN_PROGRAM_DATA_PREFIX = new TextEncoder().encode('ProgData');
 
 /**
  * tealSign creates a signature compatible with ed25519verify opcode from program hash

package/src/main.ts

@@ -1,68 +1,9 @@
-import * as nacl from './nacl/naclWrappers.js';
-import { Address } from './encoding/address.js';
-import { Transaction } from './transaction.js';
 import * as convert from './convert.js';
-import * as utils from './utils/utils.js';
-
-const SIGN_BYTES_PREFIX = Uint8Array.from([77, 88]); // "MX"
 
 // Errors
 export const MULTISIG_BAD_SENDER_ERROR_MSG =
   'The transaction sender address and multisig preimage do not match.';
 
-/**
- * signTransaction takes an object with either payment or key registration fields and
- * a secret key and returns a signed blob.
- *
- * Payment transaction fields: from, to, amount, fee, firstValid, lastValid, genesisHash,
- * note(optional), GenesisID(optional), closeRemainderTo(optional)
- *
- * Key registration fields: fee, firstValid, lastValid, voteKey, selectionKey, voteFirst,
- * voteLast, voteKeyDilution, genesisHash, note(optional), GenesisID(optional)
- *
- * If flatFee is not set and the final calculated fee is lower than the protocol minimum fee, the fee will be increased to match the minimum.
- * @param txn - object with either payment or key registration fields
- * @param sk - Algorand Secret Key
- * @returns object contains the binary signed transaction and its txID
- */
-export function signTransaction(txn: Transaction, sk: Uint8Array) {
-  return {
-    txID: txn.txID(),
-    blob: txn.signTxn(sk),
-  };
-}
-
-/**
- * signBytes takes arbitrary bytes and a secret key, prepends the bytes with "MX" for domain separation, signs the bytes
- * with the private key, and returns the signature.
- * @param bytes - Uint8array
- * @param sk - Algorand secret key
- * @returns binary signature
- */
-export function signBytes(bytes: Uint8Array, sk: Uint8Array) {
-  const toBeSigned = utils.concatArrays(SIGN_BYTES_PREFIX, bytes);
-  const sig = nacl.sign(toBeSigned, sk);
-  return sig;
-}
-
-/**
- * verifyBytes takes array of bytes, an address, and a signature and verifies if the signature is correct for the public
- * key and the bytes (the bytes should have been signed with "MX" prepended for domain separation).
- * @param bytes - Uint8Array
- * @param signature - binary signature
- * @param addr - string address
- * @returns bool
- */
-export function verifyBytes(
-  bytes: Uint8Array,
-  signature: Uint8Array,
-  addr: string | Address
-) {
-  const toBeVerified = utils.concatArrays(SIGN_BYTES_PREFIX, bytes);
-  const addrObj = typeof addr === 'string' ? Address.fromString(addr) : addr;
-  return nacl.verify(toBeVerified, signature, addrObj.publicKey);
-}
-
 export const ERROR_MULTISIG_BAD_SENDER = new Error(
   MULTISIG_BAD_SENDER_ERROR_MSG
 );
@@ -109,6 +50,10 @@ export {
   encodeAddress,
   decodeAddress,
   getApplicationAddress,
+  addressFromPQKey,
+  addressFromPQSig,
+  PQ_SCHEME_SIZE,
+  PQ_SALT_MAX,
   ALGORAND_ZERO_ADDRESS_STRING,
 } from './encoding/address.js';
 export { bytesToBigInt, bigIntToBytes } from './encoding/bigint.js';
@@ -136,6 +81,7 @@ export {
   mnemonicToSecretKey,
   seedFromMnemonic,
   mnemonicFromSeed,
+  pq25WordMnemonicToSeed,
 } from './mnemonic/mnemonic.js';
 export {
   microalgosToAlgos,
@@ -149,6 +95,11 @@ export {
   encodeUnsignedSimulateTransaction,
 } from './signedTransaction.js';
 export {
+  SIGN_BYTES_PREFIX,
+  signTransaction,
+  signTransactionWithSigner,
+  signBytes,
+  verifyBytes,
   signLogicSigTransaction,
   signLogicSigTransactionObject,
 } from './signing.js';
@@ -159,6 +110,10 @@ export {
   tealSign,
   tealSignFromProgram,
   verifyTealSign,
+  PROGRAM_TAG,
+  PQ_PROGRAM_TAG,
+  MSIG_PROGRAM_TAG,
+  SIGN_PROGRAM_DATA_PREFIX,
 } from './logicsig.js';
 export {
   MultisigMetadata,
@@ -171,6 +126,8 @@ export {
   appendSignMultisigTransaction,
   createMultisigTransaction,
   appendSignRawMultisigSignature,
+  signMultisigTransactionWithSigner,
+  appendSignMultisigTransactionWithSigner,
 } from './multisigSigning.js';
 export {
   ProgramSourceMap,
@@ -178,7 +135,20 @@ export {
   PcLineLocation,
 } from './logic/sourcemap.js';
 
-export * from './dryrun.js';
+export {
+  Ed25519SigningKey,
+  addressWithSignersFromRawEd25519Signer,
+} from './ed25519-signer.js';
+export {
+  FALCON_1024_SCHEME,
+  Falcon1024SigningKey,
+  addressWithSignersFromRawFalcon1024Signer,
+} from './falcon-signer.js';
+export {
+  PQSigningKey,
+  addressWithSignersFromRawPQSigner,
+} from './pq-signer.js';
+
 export * from './makeTxn.js';
 export * from './transaction.js';
 export * from './signer.js';

package/src/mnemonic/mnemonic.ts

@@ -1,8 +1,9 @@
 /* eslint-disable no-bitwise */
 import english from './wordlists/english.js';
 import * as nacl from '../nacl/naclWrappers.js';
-import { Address } from '../encoding/address.js';
+import { Address, PQ_SCHEME_SIZE } from '../encoding/address.js';
 import Account from '../types/account.js';
+import { concatArrays } from '../utils/utils.js';
 
 export const FAIL_TO_DECODE_MNEMONIC_ERROR_MSG = 'failed to decode mnemonic';
 export const NOT_IN_WORDS_LIST_ERROR_MSG =
@@ -179,3 +180,35 @@ export function mnemonicToMasterDerivationKey(mn: string) {
 export function masterDerivationKeyToMnemonic(mdk: Uint8Array) {
   return mnemonicFromSeed(mdk);
 }
+
+/**
+ * The domain-separation prefix prepended to a post-quantum key seed preimage
+ * before hashing. Matches go-algorand's protocol.PostQuantumKey HashID.
+ */
+const PQ_KEY_PREFIX = new TextEncoder().encode('PQK');
+
+/**
+ * pq25WordMnemonicToSeed derives a post-quantum key seed from a standard 25-word
+ * Algorand mnemonic.
+ *
+ * The seed is domain-separated by the PQ scheme, so the same mnemonic yields a
+ * different key for each scheme, and a different key again from the ed25519
+ * account that `mnemonicToSecretKey` derives from it.
+ *
+ * @param mn - A 25-word Algorand mnemonic
+ * @param scheme - The 2-byte ASCII PQ scheme identifier (e.g. "f1" for Falcon-1024)
+ * @returns The 32-byte seed to hand to the scheme's key generator
+ */
+export function pq25WordMnemonicToSeed(
+  mn: string,
+  scheme: Uint8Array
+): Uint8Array {
+  if (scheme.length !== PQ_SCHEME_SIZE) {
+    throw new Error(
+      `invalid PQ scheme length: expected ${PQ_SCHEME_SIZE} bytes, got ${scheme.length}`
+    );
+  }
+  return new Uint8Array(
+    nacl.genericHash(concatArrays(PQ_KEY_PREFIX, scheme, seedFromMnemonic(mn)))
+  );
+}