hd-wallet-wasm 2.0.32 → 2.1.0

package/dist/runtime/epm-attestation.d.ts

@@ -103,3 +103,12 @@ export function verifyAllChainProofs(
   wallet: HDWalletModule,
   chainProofs: ChainProofData[],
 ): ChainProofVerifyResult;
+
+/** DER-encode a 64-byte compact r||s ECDSA signature (the SDS EPM annex encoding). */
+export function compactSignatureToDer(compact: Uint8Array): Uint8Array;
+
+/** SHA-256(SHA-256("\x18Bitcoin Signed Message:\n" || CompactSize(len) || message)). */
+export function bitcoinSignedMessageHash(wallet: HDWalletModule, message: Uint8Array): Uint8Array;
+
+/** EIP-191 personal_sign: Keccak-256("\x19Ethereum Signed Message:\n" || decimal(len) || message). */
+export function ethereumPersonalSignHash(wallet: HDWalletModule, message: Uint8Array): Uint8Array;

package/dist/runtime/epm-attestation.mjs

@@ -217,25 +217,101 @@ export function buildEPMSigningContent(epm) {
   return new TextEncoder().encode(epmJcsCanonicalize(content));
 }
 
+// =============================================================================
+// ECDSA encodings (formatting only; hashing and signing stay in native code)
+// =============================================================================
+
+const SECP256K1_ORDER = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+const SECP256K1_HALF_ORDER = SECP256K1_ORDER >> 1n;
+
+function bytesToBigInt(bytes) {
+  let value = 0n;
+  for (const b of bytes) value = (value << 8n) | BigInt(b);
+  return value;
+}
+
+// One DER INTEGER for an unsigned big-endian scalar: minimal length, a 0x00
+// pad when the high bit is set.
+function derInteger(scalar) {
+  let start = 0;
+  while (start < scalar.length - 1 && scalar[start] === 0) start++;
+  const body = scalar.subarray(start);
+  const pad = body[0] & 0x80 ? 1 : 0;
+  const out = new Uint8Array(2 + pad + body.length);
+  out[0] = 0x02;
+  out[1] = pad + body.length;
+  out.set(body, 2 + pad);
+  return out;
+}
+
+/**
+ * Encode a 64-byte compact r||s ECDSA signature as DER
+ * (SEQUENCE { INTEGER r, INTEGER s }), the SDS EPM annex encoding.
+ *
+ * @param {Uint8Array} compact - 64-byte r||s
+ * @returns {Uint8Array} DER signature
+ */
+export function compactSignatureToDer(compact) {
+  if (!(compact instanceof Uint8Array) || compact.length !== 64) {
+    throw new TypeError('compact signature must be 64 bytes (r||s)');
+  }
+  const r = derInteger(compact.subarray(0, 32));
+  const s = derInteger(compact.subarray(32, 64));
+  const der = new Uint8Array(2 + r.length + s.length);
+  der[0] = 0x30;
+  der[1] = r.length + s.length;
+  der.set(r, 2);
+  der.set(s, 2 + r.length);
+  return der;
+}
+
+// Strict DER: exactly SEQUENCE { INTEGER r, INTEGER s } with minimal,
+// positive, nonzero integers of at most 32 bytes and no trailing bytes.
+function isStrictSecp256k1Der(der) {
+  if (!(der instanceof Uint8Array) || der.length < 8 || der.length > 72) return false;
+  if (der[0] !== 0x30 || der[1] !== der.length - 2) return false;
+  let pos = 2;
+  for (let i = 0; i < 2; i++) {
+    if (der[pos] !== 0x02) return false;
+    const len = der[pos + 1];
+    pos += 2;
+    if (len < 1 || len > 33 || pos + len > der.length) return false;
+    const body = der.subarray(pos, pos + len);
+    if (body[0] & 0x80) return false; // negative
+    if (len > 1 && body[0] === 0 && !(body[1] & 0x80)) return false; // not minimal
+    if (len === 33 && body[0] !== 0) return false;
+    const value = bytesToBigInt(body);
+    if (value === 0n || value >= SECP256K1_ORDER) return false;
+    pos += len;
+  }
+  return pos === der.length;
+}
+
 /**
  * Sign EPM content. Default curve is ed25519 (fast, the network default); pass
- * `{ curve: 'secp256k1' }` to sign with secp256k1 (ECDSA-DER over sha256(content),
- * byte-compatible with the Go/C++ EPM verifiers). The content canonicalization is
- * identical for both curves; only the signature differs.
+ * `{ curve: 'secp256k1' }` to sign with secp256k1: DER-encoded ECDSA over
+ * SHA-256 of the canonical content, hashed once (SDS EPM annex; the Go and C++
+ * EPM verifiers check exactly this). The content canonicalization is identical
+ * for both curves; only the signature differs.
  *
  * @param {Object} wallet - Initialized HDWalletModule
  * @param {Object} epm - EPM fields as a plain object (without SIGNATURE/SIGNATURE_TIMESTAMP)
  * @param {Uint8Array} privateKey - 32-byte private key (ed25519 seed or secp256k1 key)
  * @param {{ curve?: 'ed25519'|'secp256k1' }} [options]
- * @returns {{ signature: string, timestamp: number }} Hex signature and Unix timestamp
+ * @returns {{ signature: string, timestamp: number }} Hex signature (ed25519: 64 raw
+ *   bytes; secp256k1: DER) and Unix timestamp
  */
 export function signEPMContent(wallet, epm, privateKey, options = {}) {
   const curve = String(options.curve || 'ed25519').toLowerCase();
+  if (curve !== 'ed25519' && curve !== 'secp256k1') {
+    throw new Error(`signEPMContent: unsupported curve "${curve}"`);
+  }
   const timestamp = Math.floor(Date.now() / 1000);
   const content = buildEPMSigningContent({ ...epm, SIGNATURE_TIMESTAMP: timestamp });
+  // curves.secp256k1.sign hashes its input with SHA-256: pass the content itself.
   const sig =
     curve === 'secp256k1'
-      ? wallet.curves.secp256k1.sign(wallet.utils.sha256(content), privateKey)
+      ? compactSignatureToDer(wallet.curves.secp256k1.sign(content, privateKey))
       : wallet.curves.ed25519.sign(content, privateKey);
   return {
     signature: wallet.utils.encodeHex(sig),
@@ -246,8 +322,9 @@ export function signEPMContent(wallet, epm, privateKey, options = {}) {
 /**
  * Verify an EPM content signature. Dispatches on the explicit `options.curve`,
  * else infers from the public key length (32 = ed25519; 33/65 = secp256k1).
- * secp256k1 is verified as ECDSA-DER over sha256(content), matching signEPMContent
- * and the Go/C++ verifiers.
+ * secp256k1 must be a strict DER ECDSA signature over SHA-256 of the canonical
+ * content (hashed once), matching signEPMContent and the Go/C++ verifiers; a
+ * signature over SHA-256(SHA-256(content)) does not verify.
  *
  * @param {Object} wallet - Initialized HDWalletModule
  * @param {Object} epm - Full EPM object including SIGNATURE and SIGNATURE_TIMESTAMP
@@ -265,9 +342,101 @@ export function verifyEPMSignature(wallet, epm, publicKey, options = {}) {
     options.curve || (publicKey && publicKey.length === 32 ? 'ed25519' : 'secp256k1'),
   ).toLowerCase();
   if (curve === 'secp256k1') {
-    return wallet.curves.secp256k1.verify(wallet.utils.sha256(content), sig, publicKey);
+    if (!isStrictSecp256k1Der(sig)) return false;
+    return wallet.curves.secp256k1.verify(content, sig, publicKey);
   }
-  return wallet.curves.ed25519.verify(content, sig, publicKey);
+  if (curve === 'ed25519') {
+    return wallet.curves.ed25519.verify(content, sig, publicKey);
+  }
+  return false;
+}
+
+// =============================================================================
+// Chain Proof Building
+// =============================================================================
+
+// =============================================================================
+// Chain message hashes (each chain's own signed-message protocol)
+// =============================================================================
+
+function concatBytes(...parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let offset = 0;
+  for (const p of parts) {
+    out.set(p, offset);
+    offset += p.length;
+  }
+  return out;
+}
+
+// Bitcoin CompactSize (little-endian varint).
+function compactSize(length) {
+  if (length < 253) return Uint8Array.of(length);
+  if (length <= 0xffff) return Uint8Array.of(253, length & 0xff, length >>> 8);
+  if (length <= 0xffffffff) {
+    return Uint8Array.of(254, length & 0xff, (length >>> 8) & 0xff, (length >>> 16) & 0xff, length >>> 24);
+  }
+  throw new RangeError('message too long for a Bitcoin signed message');
+}
+
+const BITCOIN_MESSAGE_MAGIC = new TextEncoder().encode('\x18Bitcoin Signed Message:\n');
+
+/**
+ * Bitcoin signed-message hash: SHA-256(SHA-256("\x18Bitcoin Signed Message:\n"
+ * || CompactSize(len) || message)), the digest Bitcoin Core's signmessage signs
+ * and SDN's Go verifier recovers from. The double SHA-256 is the protocol's.
+ *
+ * @param {Object} wallet - Initialized HDWalletModule
+ * @param {Uint8Array} message - Message bytes
+ * @returns {Uint8Array} 32-byte digest
+ */
+export function bitcoinSignedMessageHash(wallet, message) {
+  const preimage = concatBytes(BITCOIN_MESSAGE_MAGIC, compactSize(message.length), message);
+  return wallet.utils.sha256(wallet.utils.sha256(preimage));
+}
+
+/**
+ * Ethereum EIP-191 personal_sign hash: Keccak-256("\x19Ethereum Signed Message:\n"
+ * || decimal(len) || message).
+ *
+ * @param {Object} wallet - Initialized HDWalletModule
+ * @param {Uint8Array} message - Message bytes
+ * @returns {Uint8Array} 32-byte digest
+ */
+export function ethereumPersonalSignHash(wallet, message) {
+  const prefix = new TextEncoder().encode(`\x19Ethereum Signed Message:\n${message.length}`);
+  return wallet.utils.keccak256(concatBytes(prefix, message));
+}
+
+// Recoverable signature over a protocol digest -> 65-byte compact header||r||s
+// (header 31 + recovery id: a compressed key, as Bitcoin Core and dcrd emit).
+function signCompactRecoverable(wallet, digest, privateKey) {
+  const { signature, recoveryId } = wallet.curves.secp256k1.signRecoverable(digest, privateKey);
+  return concatBytes(Uint8Array.of(31 + recoveryId), signature);
+}
+
+// Recover the compressed key from a 65-byte header||r||s signature over a
+// protocol digest; null when malformed. Headers 27..34 as dcrd accepts.
+function recoverCompact(wallet, digest, signature, { requireLowS }) {
+  if (signature.length !== 65) return null;
+  const header = signature[0];
+  if (header < 27 || header > 34) return null;
+  const r = bytesToBigInt(signature.subarray(1, 33));
+  const s = bytesToBigInt(signature.subarray(33, 65));
+  if (r === 0n || r >= SECP256K1_ORDER || s === 0n || s >= SECP256K1_ORDER) return null;
+  if (requireLowS && s > SECP256K1_HALF_ORDER) return null;
+  try {
+    return wallet.curves.secp256k1.recover(digest, signature.subarray(1, 65), (header - 27) & 3);
+  } catch {
+    return null;
+  }
+}
+
+function bytesEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
 }
 
 // =============================================================================
@@ -275,8 +444,9 @@ export function verifyEPMSignature(wallet, epm, publicKey, options = {}) {
 // =============================================================================
 
 /**
- * Build a Bitcoin chain proof.
- * Signs the canonical payload with secp256k1 using Bitcoin message signing format.
+ * Build a Bitcoin chain proof: a Bitcoin signed message (signmessage) over the
+ * canonical payload, as a 65-byte compact recoverable signature
+ * (header 31+recid || r || s).
  *
  * @param {Object} wallet - Initialized HDWalletModule
  * @param {Object} params
@@ -289,10 +459,7 @@ export function verifyEPMSignature(wallet, epm, publicKey, options = {}) {
  */
 export function buildBitcoinChainProof(wallet, { address, publicKeyHex, privateKey, keyPath, canonicalPayload }) {
   const payloadBytes = new TextEncoder().encode(canonicalPayload);
-  const payloadHash = wallet.utils.sha256(payloadBytes);
-  const sig = wallet.curves.secp256k1.signRecoverable
-    ? wallet.curves.secp256k1.signRecoverable(payloadHash, privateKey)
-    : wallet.curves.secp256k1.sign(payloadHash, privateKey);
+  const sig = signCompactRecoverable(wallet, bitcoinSignedMessageHash(wallet, payloadBytes), privateKey);
 
   return {
     CHAIN: 'bitcoin',
@@ -307,8 +474,9 @@ export function buildBitcoinChainProof(wallet, { address, publicKeyHex, privateK
 }
 
 /**
- * Build an Ethereum chain proof.
- * Signs the canonical payload with secp256k1 using Ethereum personal_sign prefix.
+ * Build an Ethereum chain proof: an EIP-191 personal_sign signature over the
+ * canonical payload, as a 65-byte compact recoverable signature
+ * (header 31+recid || r || s, low-S).
  *
  * @param {Object} wallet - Initialized HDWalletModule
  * @param {Object} params
@@ -321,10 +489,7 @@ export function buildBitcoinChainProof(wallet, { address, publicKeyHex, privateK
  */
 export function buildEthereumChainProof(wallet, { address, publicKeyHex, privateKey, keyPath, canonicalPayload }) {
   const payloadBytes = new TextEncoder().encode(canonicalPayload);
-  const payloadHash = wallet.utils.sha256(payloadBytes);
-  const sig = wallet.curves.secp256k1.signRecoverable
-    ? wallet.curves.secp256k1.signRecoverable(payloadHash, privateKey)
-    : wallet.curves.secp256k1.sign(payloadHash, privateKey);
+  const sig = signCompactRecoverable(wallet, ethereumPersonalSignHash(wallet, payloadBytes), privateKey);
 
   return {
     CHAIN: 'ethereum',
@@ -372,7 +537,10 @@ export function buildSolanaChainProof(wallet, { address, publicKeyHex, privateKe
 // =============================================================================
 
 /**
- * Verify a single chain proof.
+ * Verify a single chain proof. Bitcoin and Ethereum proofs are checked as their
+ * chains do (and as SDN's Go verifier does): hash the payload with the chain's
+ * signed-message protocol, recover the key from the 65-byte compact signature,
+ * and compare it with PUBLIC_KEY. Ethereum proofs must be low-S.
  *
  * @param {Object} wallet - Initialized HDWalletModule
  * @param {Object} proof - ChainProof object with CHAIN, PUBLIC_KEY, SIGNATURE, SIGNED_PAYLOAD, ALGORITHM
@@ -390,8 +558,14 @@ export function verifyChainProof(wallet, proof) {
   }
 
   if (algorithm === 'secp256k1-compact-bitcoin' || algorithm === 'secp256k1-compact-ethereum') {
-    const payloadHash = wallet.utils.sha256(payload);
-    return wallet.curves.secp256k1.verify(payloadHash, sig, pubKey);
+    if (proof.ENCODING !== undefined && proof.ENCODING !== 'compact') return false;
+    if (pubKey.length !== 33) return false;
+    const ethereum = algorithm === 'secp256k1-compact-ethereum';
+    const digest = ethereum
+      ? ethereumPersonalSignHash(wallet, payload)
+      : bitcoinSignedMessageHash(wallet, payload);
+    const recovered = recoverCompact(wallet, digest, sig, { requireLowS: ethereum });
+    return recovered !== null && bytesEqual(recovered, pubKey);
   }
 
   return false;

package/dist/runtime/index.d.ts

@@ -114,6 +114,10 @@ export interface SdnPluginInvocationResult {
 
 export interface SdnPluginCapabilities {
   randomBytes?: (length: number, context?: Record<string, unknown>) => BinaryLike;
+  /**
+   * Wallet-held signer for sign_detached. For secp256k1 it receives the message
+   * (digest is null) and must return ECDSA over SHA-256(messageBytes), hashed once.
+   */
   walletSign?: (request: {
     curve: string;
     payload: any;
@@ -731,10 +735,14 @@ export interface CurvesAPI {
 
   // ECDSA (secp256k1)
   secp256k1: {
+    /** ECDSA over SHA-256(message), hashed here: pass the message, never a hash of it. Returns 64-byte r||s. */
     sign(message: Uint8Array, privateKey: Uint8Array): Uint8Array;
-    signRecoverable(message: Uint8Array, privateKey: Uint8Array): { signature: Uint8Array; recoveryId: number };
+    /** Signs the 32-byte hash as given (no hashing): pass your protocol digest (e.g. Keccak-256). */
+    signRecoverable(hash: Uint8Array, privateKey: Uint8Array): { signature: Uint8Array; recoveryId: number };
+    /** Verifies ECDSA over SHA-256(message), hashed here; signature is 64-byte r||s or DER. */
     verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
-    recover(message: Uint8Array, signature: Uint8Array, recoveryId: number): Uint8Array;
+    /** Recovers the compressed key from a signature over the 32-byte hash, used as given. */
+    recover(hash: Uint8Array, signature: Uint8Array, recoveryId: number): Uint8Array;
     ecdh(privateKey: Uint8Array, publicKey: Uint8Array): Uint8Array;
   };
 
@@ -746,14 +754,18 @@ export interface CurvesAPI {
 
   // ECDSA (P-256)
   p256: {
+    /** ECDSA over SHA-256(message), hashed here: pass the message, never a hash of it. Returns 64-byte r||s. */
     sign(message: Uint8Array, privateKey: Uint8Array): Uint8Array;
+    /** Verifies ECDSA over SHA-256(message), hashed here. */
     verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
     ecdh(privateKey: Uint8Array, publicKey: Uint8Array): Uint8Array;
   };
 
   // ECDSA (P-384)
   p384: {
+    /** ECDSA over SHA-384(message), hashed here: pass the message, never a hash of it. Returns 96-byte r||s. */
     sign(message: Uint8Array, privateKey: Uint8Array): Uint8Array;
+    /** Verifies ECDSA over SHA-384(message), hashed here. */
     verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
     ecdh(privateKey: Uint8Array, publicKey: Uint8Array): Uint8Array;
   };

package/dist/runtime/index.mjs

@@ -9,7 +9,7 @@
  * - Transaction building and signing
  *
  * @module hd-wallet-wasm
- * @version 2.0.32
+ * @version 2.1.0
  */
 
 // Import aligned API for batch operations
@@ -1688,10 +1688,13 @@ function createModule(wasm) {
      */
     secp256k1: {
       /**
-       * Sign message with secp256k1
-       * @param {Uint8Array} message - Message to sign (typically 32-byte hash)
+       * Sign a message with secp256k1 ECDSA. Hashes the message with SHA-256
+       * internally and signs that hash (RFC 6979, low-S): pass the message, never
+       * a hash of it, or the signature covers SHA-256(SHA-256(message)) and no
+       * standard verifier accepts it.
+       * @param {Uint8Array} message - Message bytes (hashed once with SHA-256 here)
        * @param {Uint8Array} privateKey - 32-byte private key
-       * @returns {Uint8Array} Signature
+       * @returns {Uint8Array} 64-byte compact signature r||s
        */
       sign(message, privateKey) {
         const msgPtr = allocAndCopy(wasm, message);
@@ -1710,10 +1713,12 @@ function createModule(wasm) {
       },
 
       /**
-       * Sign message with recovery ID
-       * @param {Uint8Array} message - Message to sign
-       * @param {Uint8Array} privateKey - Private key
-       * @returns {Object} { signature: Uint8Array, recoveryId: number }
+       * Sign a 32-byte hash with recovery ID. Unlike sign(), the input is NOT
+       * hashed: pass the protocol digest you computed (e.g. Keccak-256 for
+       * Ethereum, the Bitcoin signed-message hash).
+       * @param {Uint8Array} message - 32-byte hash, signed as given
+       * @param {Uint8Array} privateKey - 32-byte private key
+       * @returns {Object} { signature: Uint8Array (64-byte r||s), recoveryId: number }
        */
       signRecoverable(message, privateKey) {
         const signRecoverableFn = requireWasmFunction(wasm, '_hd_secp256k1_sign_recoverable');
@@ -1738,10 +1743,11 @@ function createModule(wasm) {
       },
 
       /**
-       * Verify secp256k1 signature
-       * @param {Uint8Array} message - Original message
-       * @param {Uint8Array} signature - Signature to verify
-       * @param {Uint8Array} publicKey - Public key
+       * Verify a secp256k1 ECDSA signature over SHA-256(message). Hashes the
+       * message with SHA-256 internally: pass the message, not a hash of it.
+       * @param {Uint8Array} message - Original message bytes (hashed once with SHA-256 here)
+       * @param {Uint8Array} signature - 64-byte compact r||s or DER signature
+       * @param {Uint8Array} publicKey - 33- or 65-byte public key
        * @returns {boolean} True if valid
        */
       verify(message, signature, publicKey) {
@@ -1759,11 +1765,12 @@ function createModule(wasm) {
       },
 
       /**
-       * Recover public key from signature
-       * @param {Uint8Array} message - Original message
-       * @param {Uint8Array} signature - Signature
+       * Recover the public key from a recoverable signature. Like
+       * signRecoverable(), the input is the 32-byte hash, used as given.
+       * @param {Uint8Array} message - 32-byte hash that was signed
+       * @param {Uint8Array} signature - 64-byte r||s
        * @param {number} recoveryId - Recovery ID (0-3)
-       * @returns {Uint8Array} Recovered public key
+       * @returns {Uint8Array} Recovered 33-byte compressed public key
        */
       recover(message, signature, recoveryId) {
         const recoverFn = requireWasmFunction(wasm, '_hd_secp256k1_recover');
@@ -1881,6 +1888,13 @@ function createModule(wasm) {
      * P-256 (secp256r1) ECDSA operations
      */
     p256: {
+      /**
+       * Sign a message with P-256 ECDSA. Hashes the message with SHA-256
+       * internally: pass the message, never a hash of it.
+       * @param {Uint8Array} message - Message bytes (hashed once with SHA-256 here)
+       * @param {Uint8Array} privateKey - 32-byte private key
+       * @returns {Uint8Array} 64-byte compact signature r||s
+       */
       sign(message, privateKey) {
         const msgPtr = allocAndCopy(wasm, message);
         const keyPtr = allocAndCopy(wasm, privateKey);
@@ -1897,6 +1911,13 @@ function createModule(wasm) {
         }
       },
 
+      /**
+       * Verify a P-256 ECDSA signature over SHA-256(message).
+       * @param {Uint8Array} message - Original message bytes (hashed once with SHA-256 here)
+       * @param {Uint8Array} signature - 64-byte compact signature r||s
+       * @param {Uint8Array} publicKey - 33- or 65-byte public key
+       * @returns {boolean} True if valid
+       */
       verify(message, signature, publicKey) {
         const verifyFn = requireWasmFunction(wasm, '_hd_p256_verify');
         const msgPtr = allocAndCopy(wasm, message);
@@ -1934,6 +1955,13 @@ function createModule(wasm) {
      * P-384 (secp384r1) ECDSA operations
      */
     p384: {
+      /**
+       * Sign a message with P-384 ECDSA. Hashes the message with SHA-384
+       * internally: pass the message, never a hash of it.
+       * @param {Uint8Array} message - Message bytes (hashed once with SHA-384 here)
+       * @param {Uint8Array} privateKey - 48-byte private key
+       * @returns {Uint8Array} 96-byte compact signature r||s
+       */
       sign(message, privateKey) {
         const msgPtr = allocAndCopy(wasm, message);
         const keyPtr = allocAndCopy(wasm, privateKey);
@@ -1950,6 +1978,13 @@ function createModule(wasm) {
         }
       },
 
+      /**
+       * Verify a P-384 ECDSA signature over SHA-384(message).
+       * @param {Uint8Array} message - Original message bytes (hashed once with SHA-384 here)
+       * @param {Uint8Array} signature - 96-byte compact signature r||s
+       * @param {Uint8Array} publicKey - 49- or 97-byte public key
+       * @returns {boolean} True if valid
+       */
       verify(message, signature, publicKey) {
         const verifyFn = requireWasmFunction(wasm, '_hd_p384_verify');
         const msgPtr = allocAndCopy(wasm, message);
@@ -4707,7 +4742,7 @@ export function buildEncryptionPath(coinType, account = '0', index = '0') {
  * const seed = wallet.mnemonic.toSeed(mnemonic);
  * const root = wallet.hdkey.fromSeed(seed);
  * const { privateKey, publicKey, path } = getSigningKey(root, 60);
- * const sig = wallet.curves.secp256k1.sign(messageHash, privateKey);
+ * const sig = wallet.curves.secp256k1.sign(message, privateKey); // hashes with SHA-256
  */
 export function getSigningKey(hdRoot, coinType, account = '0', index = '0') {
   const path = buildSigningPath(coinType, account, index);
@@ -4816,4 +4851,7 @@ export {
   buildAllChainProofs,
   verifyChainProof,
   verifyAllChainProofs,
+  compactSignatureToDer,
+  bitcoinSignedMessageHash,
+  ethereumPersonalSignHash,
 } from './epm-attestation.mjs';

package/dist/runtime/sdn-plugin.mjs

@@ -105,16 +105,35 @@ function detectSigningCurve(payload) {
   return 'secp256k1';
 }
 
+function bytesEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a[i] ^ b[i];
+  }
+  return diff === 0;
+}
+
+// secp256k1-sha256 is ECDSA over SHA-256(message), hashed once by
+// curves.secp256k1.sign/verify. The digest is reported, never signed: a
+// caller digest that is not SHA-256(message) is refused rather than signed
+// (which would be ECDSA over SHA-256(digest)).
 function resolveSigningInput(wallet, payload, curve) {
   const messageBytes = toUint8Array(
     payload.messageBytes ?? payload.message ?? payload.protectedRecordBytes,
     'message'
   );
   if (curve === 'secp256k1') {
-    return {
-      messageBytes,
-      digest: optionalUint8Array(payload.digest, 'digest') ?? wallet.utils.sha256(messageBytes),
-    };
+    const digest = wallet.utils.sha256(messageBytes);
+    const callerDigest = optionalUint8Array(payload.digest, 'digest');
+    if (callerDigest && !bytesEqual(callerDigest, digest)) {
+      throw new Error(
+        'secp256k1-sha256 signs the message bytes; digest must be omitted or equal SHA-256(message).'
+      );
+    }
+    return { messageBytes, digest };
   }
   return {
     messageBytes,
@@ -133,11 +152,13 @@ function resolveSignatureEnvelope(wallet, payload, walletSign) {
   }
 
   if (typeof walletSign === 'function' && !payload.signerPrivateKey) {
+    // secp256k1: the wallet gets the message and hashes it once itself; it is
+    // never handed a digest to sign. ed25519 prehash keeps its digest input.
     const response = walletSign({
       curve,
       payload,
       messageBytes,
-      digest,
+      digest: curve === 'secp256k1' ? null : digest,
     });
     if (!response || typeof response !== 'object') {
       throw new Error('walletSign capability must return a signature envelope.');
@@ -181,7 +202,7 @@ function resolveSignatureEnvelope(wallet, payload, walletSign) {
     algorithm: payload.algorithm ?? 'secp256k1-sha256',
     messageBytes,
     digest,
-    signature: wallet.curves.secp256k1.sign(digest, privateKey),
+    signature: wallet.curves.secp256k1.sign(messageBytes, privateKey),
     publicKey:
       optionalUint8Array(payload.publicKey, 'publicKey') ??
       wallet.curves.publicKeyFromPrivate(privateKey, 0),
@@ -193,7 +214,7 @@ function resolveVerificationEnvelope(wallet, payload) {
   const signature = toUint8Array(payload.signature, 'signature');
   const publicKey = toUint8Array(payload.publicKey, 'publicKey');
   const { messageBytes, digest } = resolveSigningInput(wallet, payload, curve);
-  const verificationInput = curve === 'secp256k1' ? digest : digest ?? messageBytes;
+  const verificationInput = curve === 'secp256k1' ? messageBytes : digest ?? messageBytes;
   const valid =
     curve === 'ed25519'
       ? wallet.curves.ed25519.verify(verificationInput, signature, publicKey)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hd-wallet-wasm",
-  "version": "2.0.32",
+  "version": "2.1.0",
   "description": "Comprehensive HD Wallet implementation in WebAssembly - BIP-32/39/44, multi-curve, multi-chain support",
   "type": "module",
   "main": "./dist/runtime/index.mjs",
@@ -92,5 +92,5 @@
   "devDependencies": {
     "@types/node": "^20.0.0"
   },
-  "gitHead": "040f9ccc2f9f49069a4d1657c09b743beff3aec6"
+  "gitHead": "62e752dfd9b7163619bfbe61a52b158532fc59c1"
 }