feat: implement HD keys for secp256k1 (#742)

* feat: implement HD keys for secp256k1

* fix merge

GitOrigin-RevId: 57793a5cf1cf6cd44c2e68d06841cfced67222cf

Author: robdefeo

cipher/nacl/nacl_test.go

@@ -24,30 +24,30 @@ func Test_easySeal(t *testing.T) {
 		wantErr bool
 	}{
 		{
-			"success-bob",
+			"success-2e322f...",
 			args{
 				[]byte("message"),
-				ed25519test.BobPublicKey.Bytes(),
+				[]byte{0x2e, 0x32, 0x2f, 0x87, 0x40, 0xc6, 0x1, 0x72, 0x11, 0x1a, 0xc8, 0xea, 0xdc, 0xdd, 0xa2, 0x51, 0x2f, 0x90, 0xd0, 0x6d, 0xe, 0x50, 0x3e, 0xf1, 0x89, 0x97, 0x9a, 0x15, 0x9b, 0xec, 0xe1, 0xe8},
 				bytes.NewReader([]byte("ABCDEFGHIJKLMNOPQRSTUVWXYZ")),
 			},
 			[]byte{0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x5b, 0x19, 0x83, 0xe5, 0x6e, 0x7f, 0xed, 0xfe, 0xbb, 0xd0, 0x70, 0x34, 0xce, 0x25, 0x49, 0x76, 0xa3, 0x50, 0x78, 0x91, 0x18, 0xe6, 0xe3},
 			false,
 		},
 		{
-			"success-alice-sr25519",
+			"success-169a11...",
 			args{
 				[]byte("message"),
-				sr25519test.AlicePublicKey.Bytes(),
+				[]byte{0x16, 0x9a, 0x11, 0x72, 0x18, 0x51, 0xf5, 0xdf, 0xf3, 0x54, 0x1d, 0xd5, 0xc4, 0xb0, 0xb4, 0x78, 0xac, 0x1c, 0xd0, 0x92, 0xc9, 0xd5, 0x97, 0x6e, 0x83, 0xda, 0xa0, 0xd0, 0x3f, 0x26, 0x62, 0xc},
 				bytes.NewReader([]byte("ABCDEFGHIJKLMNOPQRSTUVWXYZ")),
 			},
 			[]byte{0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0xa3, 0x81, 0x27, 0x6f, 0xdb, 0x97, 0x17, 0x51, 0x10, 0x1e, 0x17, 0x2c, 0xec, 0x5b, 0xae, 0xdc, 0x7, 0x26, 0xea, 0x16, 0xe4, 0xc7, 0xde},
 			false,
 		},
 		{
-			"success-bob-sr25519",
+			"success-84623e...",
 			args{
 				[]byte("message"),
-				sr25519test.BobPublicKey.Bytes(),
+				[]byte{0x84, 0x62, 0x3e, 0x72, 0x52, 0xe4, 0x11, 0x38, 0xaf, 0x69, 0x4, 0xe1, 0xb0, 0x23, 0x4, 0xc9, 0x41, 0x62, 0x5f, 0x39, 0xe5, 0x76, 0x25, 0x89, 0x12, 0x5d, 0xc1, 0xa2, 0xf2, 0xcf, 0x2e, 0x30},
 				bytes.NewReader([]byte("ABCDEFGHIJKLMNOPQRSTUVWXYZ")),
 			},
 			[]byte{0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x6, 0x3e, 0xa1, 0x2c, 0xa5, 0x8e, 0x6b, 0x36, 0x98, 0xf8, 0x0, 0x56, 0x74, 0xfe, 0x32, 0x9a, 0x3e, 0x60, 0xf1, 0x1b, 0x53, 0x6d, 0x77},

factory/seed.go

@@ -0,0 +1,25 @@
+package factory
+
+import (
+	"crypto/rand"
+	"io"
+)
+
+// NewSeed returns a cryptographically secure random seed. Random seeds are needed
+// when creating a new secure private key.
+
+// The length of the seed depends on it's usage. In most cases seed length is between
+// 16 and 64 making it (128 to 512 bits).
+func NewSeed(length uint8) ([]byte, error) {
+	return generateSeed(rand.Reader, length)
+}
+
+func generateSeed(r io.Reader, length uint8) ([]byte, error) {
+	buf := make([]byte, length)
+
+	if _, err := r.Read(buf); err != nil {
+		return nil, err
+	}
+
+	return buf, nil
+}

factory/seed_test.go

@@ -0,0 +1,55 @@
+package factory
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"testing"
+	"testing/iotest"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_generateSeed(t *testing.T) {
+	type args struct {
+		r      io.Reader
+		length uint8
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    []byte
+		wantErr bool
+	}{
+		{
+			"success",
+			args{
+				bytes.NewReader([]byte("ABCDEFGHIJKLMNOPQRSTUVWXYZ")),
+				16,
+			},
+			[]byte{0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50},
+			false,
+		},
+		{
+			"err",
+			args{
+				iotest.ErrReader(errors.New("error")),
+				255,
+			},
+			nil,
+			true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := generateSeed(tt.args.r, tt.args.length)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("generateSeed() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !assert.Equal(t, tt.want, got) {
+				t.Errorf("generateSeed() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

private.go

@@ -26,3 +26,10 @@ type PrivateKey interface {
 	// Sign signs the message with the key and returns the signature.
 	Sign(message []byte) ([]byte, error)
 }
+
+type ExtendedPrivateKey interface {
+	Bytes() []byte
+	PrivateKey() PrivateKey
+	Derive(index uint32) (ExtendedPrivateKey, error)
+	ExtendedPublicKey() (ExtendedPublicKey, error)
+}

public.go

@@ -26,3 +26,9 @@ type PublicKey interface {
 	// Verify verifies whether sig is a valid signature of message.
 	Verify(message, sig []byte) bool
 }
+
+type ExtendedPublicKey interface {
+	Bytes() []byte
+	PublicKey() PublicKey
+	Derive(index uint32) (ExtendedPublicKey, error)
+}

secp256k1/extended_end_to_end_test.go

@@ -0,0 +1,147 @@
+package secp256k1_test
+
+import (
+	"testing"
+
+	"github.com/mailchain/mailchain/crypto"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPrivatePublic_Derive(t *testing.T) {
+	testVec1MasterPrivKey := "xprv9wNUHWVTuAHnj7y9JJRvdqgd8jsN5QuzdPt7EuBXfXXgjMEWPc5dENSs3HKvXvoPMyJsBpSMkEryBEz3kxdRg8fpAfq9RYh4wiysZihDR2r"
+	testVec1MasterPubKey := "xpub6AMph22MjXr5wc3cQKxvzydMgmhrUsdqzcoi3Hb9Ds4fc9Zew9PsnAmLtaBNTZCtzsZfLMgBM6DEFZGX2A4kHWDatJj6cfbRH896d2ACi4F"
+	testVec2MasterPrivKey := "xprv9wHokC2KXdTSpEepFcu53hMDUHYfAtTaLEJEMyxBPAMf78hJg17WhL5FyeDUQH5KWmGjGgEb2j74gsZqgupWpPbZgP6uFmP8MYEy5BNbyET"
+	testVec2MasterPubKey := "xpub6AHA9hZDN11k2ijHMeS5QqHx2KP9aMBRhTDqANMnwVtdyw2TDYRmF8PjpvwUFcL1Et8Hj59S3gTSMcUQ5gAqTz3Wd8EsMTmF3DChhqPQBnU"
+
+	tests := []struct {
+		name       string
+		privateKey crypto.ExtendedPrivateKey
+		publicKey  crypto.ExtendedPublicKey
+		path       []uint32
+		wantErr    bool
+	}{
+		{
+			"test vector 1 chain m/0/1",
+			privateKeyFromBIP32String(t, testVec1MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec1MasterPubKey),
+			[]uint32{0, 1},
+			false,
+		},
+		{
+			"test vector 1 chain m",
+			privateKeyFromBIP32String(t, testVec1MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec1MasterPubKey),
+			[]uint32{},
+			false,
+		},
+		{
+			"test vector 1 chain m/0",
+			privateKeyFromBIP32String(t, testVec1MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec1MasterPubKey),
+			[]uint32{0},
+			false,
+		},
+		{
+			"test vector 1 chain m/0/1",
+			privateKeyFromBIP32String(t, testVec1MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec1MasterPubKey),
+			[]uint32{0, 1},
+			false,
+		},
+		{
+			"test vector 1 chain m/0/1/2",
+			privateKeyFromBIP32String(t, testVec1MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec1MasterPubKey),
+			[]uint32{0, 1, 2},
+			false,
+		},
+		{
+			"test vector 1 chain m/0/1/2/2",
+			privateKeyFromBIP32String(t, testVec1MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec1MasterPubKey),
+			[]uint32{0, 1, 2, 2},
+			false,
+		},
+		{
+			"test vector 1 chain m/0/1/2/2/1000000000",
+			privateKeyFromBIP32String(t, testVec1MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec1MasterPubKey),
+			[]uint32{0, 1, 2, 2, 1000000000},
+			false,
+		},
+
+		// // Test vector 2
+		{
+			"test vector 2 chain m",
+			privateKeyFromBIP32String(t, testVec2MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec2MasterPubKey),
+			[]uint32{},
+			false,
+		},
+		{
+			"test vector 2 chain m/0",
+			privateKeyFromBIP32String(t, testVec2MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec2MasterPubKey),
+			[]uint32{0},
+			false,
+		},
+		{
+			"test vector 2 chain m/0/2147483647",
+			privateKeyFromBIP32String(t, testVec2MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec2MasterPubKey),
+			[]uint32{0, 2147483647},
+			false,
+		},
+		{
+			"test vector 2 chain m/0/2147483647/1",
+			privateKeyFromBIP32String(t, testVec2MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec2MasterPubKey),
+			[]uint32{0, 2147483647, 1},
+			false,
+		},
+		{
+			"test vector 2 chain m/0/2147483647/1/2147483646",
+			privateKeyFromBIP32String(t, testVec2MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec2MasterPubKey),
+			[]uint32{0, 2147483647, 1, 2147483646},
+			false,
+		},
+		{
+			"test vector 2 chain m/0/2147483647/1/2147483646/2",
+			privateKeyFromBIP32String(t, testVec2MasterPrivKey),
+			publicKeyFromBIP32String(t, testVec2MasterPubKey),
+			[]uint32{0, 2147483647, 1, 2147483646, 2},
+			false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			extPrvKey := tt.privateKey
+			extPubKey := tt.publicKey
+			var err error
+
+			for _, childNum := range tt.path {
+				extPrvKey, err = extPrvKey.Derive(childNum)
+				if !assert.NoError(t, err) {
+					assert.FailNow(t, "error not expected")
+				}
+			}
+
+			for _, childNum := range tt.path {
+				extPubKey, err = extPubKey.Derive(childNum)
+				if !assert.NoError(t, err) {
+					assert.FailNow(t, "error not expected")
+				}
+			}
+
+			pubKey, err := extPrvKey.ExtendedPublicKey()
+			if !assert.NoError(t, err) {
+				assert.FailNow(t, "error not expected")
+			}
+
+			if !assert.Equal(t, pubKey, extPubKey) {
+				t.Errorf("RoundTripParse and Derive = %v, want %v", pubKey.Bytes(), extPubKey.Bytes())
+			}
+		})
+	}
+}