592a622b4 Add detection of liquidv1 fedpeg script, startup sanity check (Gregory Sanders)
Pull request description:
And use it to sanity check startup constants.
Tree-SHA512: 1e4c3910c5c269384b5dab7a3f38646356a8de7684515324320d610915466e5015e9993d7a2a619473ea3500f3f9145526414548d6da6ee22b4417b6836042bf
19ef5e3cb Add link to pak authorization design in secp-zpk (Gregory Sanders)
1cb252e01 Descriptor support in PAK infrastructure and tests (Gregory Sanders)
636673447 Properly encode parent witness addresses (Gregory Sanders)
7e63ce39e Extend validateaddress to check parent address validity. (Gregory Sanders)
85bcda52f pak mempool removal: don't modify the vector you are taking range over (Gregory Sanders)
8de42370d fixup mempool clearing of peg-outs on block commitment (Gregory Sanders)
542b826c9 ScriptHasvalidPAKProof: Allow any standard single-key output script type (Gregory Sanders)
71acfb359 Add IsPayToWitnessPubkeyHash convenience function (Gregory Sanders)
1241343bd testproposedblock: Reject blocks with non-matching pak commitments (Gregory Sanders)
47ea638b4 miner adds commitment when pak enforcement is set only (Gregory Sanders)
3fc3ac340 disallow pak enforcement arg when nonstandard tx are possible (Gregory Sanders)
dfe5331db Miner adds PAK commitments when config 'disagress' with block commits (Gregory Sanders)
bcd8db972 functional test for pak feature (Gregory Sanders)
5b6d767b6 Load PAK arguments from config and disk on startup (Gregory Sanders)
d391782cd Add getwalletpakinfo RPC call (Gregory Sanders)
f06e6f648 Wallet offline_counter starts at -1 (Gregory Sanders)
0e52456f3 Return status of pak enforcement on the blockchain in (Gregory Sanders)
050bb4905 Add getpakinfo RPC call, without wallet state (Gregory Sanders)
3cfe2d49e Add sendtomainchain RPC call which is used when -pak_enforce is enabled (Gregory Sanders)
567de67af Break out sendtomainchain to call functions based on -enforce_pak (Gregory Sanders)
070be0f5c add initpegout RPC for peg-out wallet initialization (Gregory Sanders)
47422e71d Write and load peg-out wallet functions on wallet load (Gregory Sanders)
4e631bd77 Add derivation helpers for peg-out wallet infrastructure (Gregory Sanders)
1559cc9c3 C(Pub)Key::Derive: Return optional tweak vector for peg-out wallets (Gregory Sanders)
f1dbd1cf3 -multi_data_permitted: Allow >1 op_return output by policy (Gregory Sanders)
9f5cc03f9 Read PAK list from connected blocks, save list, and boot transactions not conforming (Gregory Sanders)
86fbc2418 GetPAKKeysFromCommitment utility function (Gregory Sanders)
bf66d77a8 Add Read/Write functions to txdb for PAK lists (Gregory Sanders)
2b4899dd3 PAK enforcement via standardness, drop multi-op_return restriction (Gregory Sanders)
6679823fc Create global PAK lists for config and blockchain state (Gregory Sanders)
8c7746c4d Add CScript::IsPayToPubkeyHash convienience function (Gregory Sanders)
43424cbf7 Add PAK proof validation function (Gregory Sanders)
378e59461 Define PAKList structure and operations (Gregory Sanders)
40571ab6d Turn on secp-zkp experimental modules for PAK (Gregory Sanders)
893628be01 Drop minor GetSerializeSize template (Ben Woosley)
da74db0940 Drop unused GetType() from CSizeComputer (Ben Woosley)
Pull request description:
Based on conversation in #13462, it seems the serialization `GetType` has very narrow use/effect. In every case except for `CAddress`, which specifically relates to a network peer's address, not a wallet address etc., the serialized representation of an object is irrespective of its destination / type.
This removes the unused `GetType` method from `CSizeComputer` as a step to further narrowing that use.
Tree-SHA512: e72b8e9e5160396691e05aeaee3aba5a57935a75bd5005cfcc7fb51c936f3d1728a397f999da5c36696506dd815fafa5c738f3894df8864f25f91f639eba9c3d
917353c8b0 Make SignPSBTInput operate on a private SignatureData object (Pieter Wuille)
cad5dd2368 Pass HD path data through SignatureData (Pieter Wuille)
03a99586a3 Implement key origin lookup in CWallet (Pieter Wuille)
3b01efa0d1 [MOVEONLY] Move ParseHDKeypath to utilstrencodings (Pieter Wuille)
81e1dd5ce1 Generalize PublicOnlySigningProvider into HidingSigningProvider (Pieter Wuille)
84f1f1bfdf Make SigningProvider expose key origin information (Pieter Wuille)
611ab307fb Introduce KeyOriginInfo for fingerprint + path (Pieter Wuille)
Pull request description:
This PR adds "key origin" (master fingeprint + key path) information to what is exposed from `SigningProvider`s, allowing this information to be used by the generic PSBT code instead of having the RPC pull it directly from the wallet.
This is also a preparation to having PSBT interact with output descriptors, which can then directly expose key origin information for the scripts they generate.
Tree-SHA512: c718382ba8ba2d6fc9a32c062bd4cff08b6f39b133838aa03115c39aeca0f654c7cc3ec72d87005bf8306e550824cd8eb9d60f0bd41784a3e22e17b2afcfe833
984d72ec65 Return the script type from Solver (Ben Woosley)
Pull request description:
Because false is synonymous with TX_NONSTANDARD, this conveys the same
information and makes the handling explicitly based on script type,
simplifying each call site.
Prior to this change it was common for the return value to be ignored, or for the
return value and TX_NONSTANDARD to be redundantly handled.
Tree-SHA512: 31864f856b8cb75f4b782d12678070e8b1cfe9665c6f57cfb25e7ac8bcea8a22f9a78d7c8cf0101c841f2a612400666fb91798bffe88de856e98b873703b0965
Strip out the witnesses when serializing the non-witness utxo. However
witness serializations are allowed, so make sure we always deserialize
as witness.
GitHub-Pull: #13960
Rebased-From: bd19cc7
0-input transactions can be ambiguously deserialized as being witness
transactions. Since the unsigned transaction is never serialized as
a witness transaction as it has no witnesses, we should always
deserialize it as a non-witness transaction and set the serialization
flags as such.
Also always serialize the unsigned transaction as a non-witness transaction.
GitHub-Pull: #13960
Rebased-From: 43811e6
5df6f089b5 More tests of signer checks (Andrew Chow)
7c8bffdc24 Test that a non-witness script as witness utxo is not signed (Andrew Chow)
8254e9950f Additional sanity checks in SignPSBTInput (Pieter Wuille)
c05712cb59 Only wipe wrong UTXO type data if overwritten by wallet (Pieter Wuille)
Pull request description:
The current PSBT signing code can end up producing a non-segwit signature, while only the UTXO being spent is provided in the PSBT (as opposed to the entire transaction being spent). This may be used to trick a user to incorrectly decide a transaction has the semantics he intends to sign.
Fix this by refusing to sign if there is any mismatch between the provided data and what is being signed.
Tree-SHA512: b55790d79d8166e05513fc4c603a982a33710e79dc3c045060cddac6b48a1be3a28ebf8db63f988b6567b15dd27fd09bbaf48846e323c8635376ac20178956f4
Strip out the witnesses when serializing the non-witness utxo. However
witness serializations are allowed, so make sure we always deserialize
as witness.
0-input transactions can be ambiguously deserialized as being witness
transactions. Since the unsigned transaction is never serialized as
a witness transaction as it has no witnesses, we should always
deserialize it as a non-witness transaction and set the serialization
flags as such.
Also always serialize the unsigned transaction as a non-witness transaction.
6ad0328f1c Don't assert(foo()) where foo has side effects (practicalswift)
Pull request description:
Don't `assert(foo())` where `foo` has side effects.
From `assert(3)`:
> If the macro `NDEBUG` is defined at the moment `<assert.h>` was last included, the macro `assert()` generates no code, and hence does nothing at all.
Bitcoin currently cannot be compiled without assertions, but we shouldn't rely on that.
Tree-SHA512: 28cff0c6d1c2fb612ca58c9c94142ed01c5cfd0a2fecb8e59cdb6c270374b215d952ed3491d921d84dc1b439fa49da4f0e75e080f6adcbc6b0e08be14e54c170
e306be7429 Use 72 byte dummy signatures when watching only inputs may be used (Andrew Chow)
48b1473c89 Use 71 byte signature for DUMMY_SIGNATURE_CREATOR (Andrew Chow)
18dfea0dd0 Always create 70 byte signatures with low R values (Andrew Chow)
Pull request description:
When creating signatures for transactions, always make one which has a 32 byte or smaller R and 32 byte or smaller S value. This results in signatures that are always less than 71 bytes (32 byte R + 32 byte S + 6 bytes DER + 1 byte sighash) with low R values. In most cases, the signature will be 71 bytes.
Because R is not mutable in the same way that S is, a low R value can only be found by trying different nonces. RFC 6979 for deterministic nonce generation has the option to specify additional entropy, so we simply use that and add a uin32_t counter which we increment in order to try different nonces. Nonces are sill deterministically generated as the nonce used will the be the first one where the counter results in a nonce that results in a low R value. Because different nonces need to be tried, time to produce a signature does increase. On average, it takes twice as long to make a signature as two signatures need to be created, on average, to find one with a low R.
Having a fixed size signature makes size calculations easier and also saves half a byte of transaction size, on average.
DUMMY_SIGNATURE_CREATOR has been modified to produce 71 byte dummy signatures instead of 72 byte signatures.
Tree-SHA512: 3cd791505126ce92da7c631856a97ba0b59e87d9c132feff6e0eef1dc47768e81fbb38bfbe970371bedf9714b7f61a13a5fe9f30f962c81734092a4d19a4ef33
With watching only inputs, we do not know how large the signatures
for those inputs will be as their signers may not have implemented
71 byte signatures. Thus we estimate their fees using the 72 byte
dummy signature to ensure that we pay enough fees.
This only effects fundrawtransaction when includeWatching is true.
