-
Notifications
You must be signed in to change notification settings - Fork 1
/
signature_creator.go
316 lines (278 loc) · 8.88 KB
/
signature_creator.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
package zcash
import (
"bytes"
"encoding/binary"
"fmt"
"github.com/btcsuite/btcd/chaincfg/chainhash"
"github.com/btcsuite/btcd/txscript"
btc "github.com/btcsuite/btcutil"
"golang.org/x/crypto/blake2b"
)
type SignatureCreator interface {
CreateSig(address btc.Address, scriptCode []byte, consensusBranchId uint32) ([]byte, bool)
txscript.KeyDB
txscript.ScriptDB
}
func TransactionSignatureCreator(kdb txscript.KeyDB, sdb txscript.ScriptDB, tx *Transaction, idx int, hashType txscript.SigHashType) SignatureCreator {
return &signatureCreator{
KeyDB: kdb,
ScriptDB: sdb,
tx: tx,
idx: idx,
hashType: hashType,
}
}
type signatureCreator struct {
txscript.KeyDB
txscript.ScriptDB
tx *Transaction
idx int
hashType txscript.SigHashType
}
func (s *signatureCreator) CreateSig(address btc.Address, scriptCode []byte, consensusBranchId uint32) ([]byte, bool) {
key, _, err := s.GetKey(address)
if err != nil {
return nil, false
}
hash, err := SignatureHash(scriptCode, s.tx, s.idx, s.hashType, consensusBranchId)
if err != nil {
return nil, false
}
signature, err := key.Sign(hash)
if err != nil {
return nil, false
}
return append(signature.Serialize(), byte(s.hashType)), true
}
var (
PrevoutsHashPersonalization = []byte("ZcashPrevoutHash")
SequenceHashPersonalization = []byte("ZcashSequencHash")
OutputsHashPersonalization = []byte("ZcashOutputsHash")
JoinSplitsHashPersonalization = []byte("ZcashJSplitsHash")
)
func SignatureHash(scriptCode []byte, tx *Transaction, idx int, hashType txscript.SigHashType, consensusBranchId uint32) ([]byte, error) {
if idx >= len(tx.Inputs) && idx != NotAnInput {
// index out of range
return nil, fmt.Errorf("input index is out of range")
}
if tx.IsOverwinter {
return overwinterSignatureHash(scriptCode, tx, idx, hashType, consensusBranchId)
}
return sproutSignatureHash(scriptCode, tx, idx, hashType)
}
func overwinterSignatureHash(scriptCode []byte, tx *Transaction, idx int, hashType txscript.SigHashType, consensusBranchId uint32) ([]byte, error) {
/*
BLAKE2b-256 hash of the serialization of:
1. header of the transaction (4-byte little endian)
2. nVersionGroupId of the transaction (4-byte little endian)
3. hashPrevouts (32-byte hash)
4. hashSequence (32-byte hash)
5. hashOutputs (32-byte hash)
6. hashJoinSplits (32-byte hash)
7. nLockTime of the transaction (4-byte little endian)
8. nExpiryHeight of the transaction (4-byte little endian)
9. sighash type of the signature (4-byte little endian)
10. If we are serializing an input (i.e. this is not a JoinSplit signature hash):
a. outpoint (32-byte hash + 4-byte little endian)
b. scriptCode of the input (serialized as scripts inside CTxOuts)
c. value of the output spent by this input (8-byte little endian)
d. nSequence of the input (4-byte little endian)
*/
// The default values are zeroes
var hashPrevouts, hashSequence, hashOutputs, hashJoinSplits []byte
if (hashType & txscript.SigHashAnyOneCanPay) == 0 {
ss, err := blake2b.New256(PrevoutsHashPersonalization)
if err != nil {
return nil, err
}
for _, input := range tx.Inputs {
if err := input.writeOutPoint(ss); err != nil {
return nil, err
}
}
hashPrevouts = ss.Sum(nil)
}
if (hashType&txscript.SigHashAnyOneCanPay == 0) && (hashType&sigHashMask) != txscript.SigHashSingle && (hashType&sigHashMask) != txscript.SigHashNone {
ss, err := blake2b.New256(SequenceHashPersonalization)
if err != nil {
return nil, err
}
for _, input := range tx.Inputs {
if err := writeField(input.Sequence)(ss); err != nil {
return nil, err
}
}
hashSequence = ss.Sum(nil)
}
if (hashType&sigHashMask) != txscript.SigHashSingle && (hashType&sigHashMask) != txscript.SigHashNone {
ss, err := blake2b.New256(OutputsHashPersonalization)
if err != nil {
return nil, err
}
for _, output := range tx.Outputs {
if _, err := output.WriteTo(ss); err != nil {
return nil, err
}
}
hashOutputs = ss.Sum(nil)
} else if (hashType&sigHashMask) == txscript.SigHashSingle && idx < len(tx.Outputs) {
ss, err := blake2b.New256(OutputsHashPersonalization)
if err != nil {
return nil, err
}
if _, err := tx.Outputs[idx].WriteTo(ss); err != nil {
return nil, err
}
hashOutputs = ss.Sum(nil)
}
if len(tx.JoinSplits) > 0 {
ss, err := blake2b.New256(JoinSplitsHashPersonalization)
if err != nil {
return nil, err
}
for _, js := range tx.JoinSplits {
if _, err := js.WriteTo(ss); err != nil {
return nil, err
}
}
if err := writeBytes(tx.JoinSplitPubKey[:])(ss); err != nil {
return nil, err
}
hashJoinSplits = ss.Sum(nil)
}
personalization := bytes.NewBufferString("ZcashSigHash")
if err := writeField(consensusBranchId)(personalization); err != nil {
return nil, err
}
ss, err := blake2b.New256(personalization.Bytes())
if err != nil {
return nil, err
}
if err := writeAll(ss,
// fOverwintered and nVersion
tx.GetHeader(),
// Version group ID
tx.VersionGroupID,
// Input prevouts/nSequence (none/all, depending on flags)
hashPrevouts,
hashSequence,
// Outputs (none/one/all, depending on flags)
hashOutputs,
// JoinSplits
hashJoinSplits,
// Locktime
tx.LockTime,
// Expiry height
tx.ExpiryHeight,
// Sighash type
hashType,
); err != nil {
return nil, err
}
if idx != NotAnInput {
// The input being signed (replacing the scriptSig with scriptCode + amount)
// The prevout may already be contained in hashPrevout, and the nSequence
// may already be contained in hashSequence.
var amountIn int64
if idx < len(tx.Outputs) {
amountIn = tx.Outputs[idx].Value
}
if err := tx.Inputs[idx].writeOutPoint(ss); err != nil {
return nil, err
}
if err := writeAll(ss, scriptCode, amountIn, tx.Inputs[idx].Sequence); err != nil {
return nil, err
}
}
return ss.Sum(nil), nil
}
// sigHashMask defines the number of bits of the hash type which is used
// to identify which outputs are signed.
const sigHashMask = 0x1f
func sproutSignatureHash(scriptCode []byte, tx *Transaction, idx int, hashType txscript.SigHashType) ([]byte, error) {
var one chainhash.Hash
one[0] = 0x01
if idx >= len(tx.Inputs) || idx == NotAnInput {
return one[:], nil
}
txCopy := tx.shallowCopy()
// Blank out other inputs' signatures
for i := range txCopy.Inputs {
txCopy.Inputs[i].SignatureScript = nil
}
txCopy.Inputs[idx].SignatureScript = scriptCode
switch hashType & sigHashMask {
case txscript.SigHashNone:
txCopy.Outputs = txCopy.Outputs[0:0] // Empty slice.
for i := range txCopy.Inputs {
if i != idx {
txCopy.Inputs[i].Sequence = 0
}
}
case txscript.SigHashSingle:
if idx >= len(tx.Outputs) {
// nOut out of range
return nil, fmt.Errorf("no matching output for SIGHASH_SINGLE")
}
// Resize output array to up to and including requested index.
txCopy.Outputs = txCopy.Outputs[:idx+1]
// All but current output get zeroed out.
for i := 0; i < idx; i++ {
txCopy.Outputs[i].Value = -1
txCopy.Outputs[i].ScriptPubKey = nil
}
// Sequence on all other inputs is 0, too.
for i := range txCopy.Inputs {
if i != idx {
txCopy.Inputs[i].Sequence = 0
}
}
default:
// Consensus treats undefined hashtypes like normal SigHashAll
// for purposes of hash generation.
fallthrough
case txscript.SigHashOld:
fallthrough
case txscript.SigHashAll:
// Nothing special here.
}
// Blank out other inputs completely, not recommended for open transactions
if hashType&txscript.SigHashAnyOneCanPay != 0 {
txCopy.Inputs = txCopy.Inputs[idx : idx+1]
}
// Blank out the joinsplit signature.
txCopy.JoinSplitSignature = [64]byte{}
// Serialize and hash
buf := &bytes.Buffer{}
txCopy.WriteTo(buf)
binary.Write(buf, binary.LittleEndian, hashType)
return chainhash.DoubleHashB(buf.Bytes()), nil
}
// shallowCopy creates a shallow copy of the transaction for use when
// calculating the signature hash. It is used over the Copy method on the
// transaction itself since that is a deep copy and therefore does more work and
// allocates much more space than needed.
func (tx Transaction) shallowCopy() Transaction {
// As an additional memory optimization, use contiguous backing arrays
// for the copied inputs and outputs and point the final slice of
// pointers into the contiguous arrays. This avoids a lot of small
// allocations.
txCopy := tx
txCopy.Inputs = make([]Input, len(tx.Inputs))
txCopy.Outputs = make([]Output, len(tx.Outputs))
txCopy.JoinSplits = make([]JoinSplit, len(tx.JoinSplits))
txCopy.JoinSplitPubKey = [32]byte{}
txCopy.JoinSplitSignature = [64]byte{}
for i, input := range tx.Inputs {
txCopy.Inputs[i] = input
}
for i, output := range tx.Outputs {
txCopy.Outputs[i] = output
}
for i, joinSplit := range tx.JoinSplits {
txCopy.JoinSplits[i] = joinSplit
}
copy(txCopy.JoinSplitPubKey[:], tx.JoinSplitPubKey[:])
copy(txCopy.JoinSplitSignature[:], tx.JoinSplitSignature[:])
return txCopy
}