Silent Payments: Implement bip352 (take 2) #35301

  20 | +#include <script/solver.h>
  21 | +#include <script/script_error.h>
  22 | +#include <util/check.h>
  23 | +#include <util/strencodings.h>
  24 | +
  25 | +extern secp256k1_context* secp256k1_context_sign; // TODO: this is hacky, is there a better solution?

---

  98 | + * Label public keys can be stored in a cache, mapping the public key to the label tweak. This cache
  99 | + * is used during scanning to determine if a label was used and if so to retrieve the label tweak.
 100 | + *
 101 | + * @param scan_key                 The recipient's scan_key, used to salt the hash
 102 | + * @param m                        An integer m (only use m = 0 for the change label)
 103 | + * @return std::<CPubKey, uint156> The label public key and label tweak.

---

 151 | + * @param spend_pubkey                                      The recipient's spend public key.
 152 | + * @param output_pub_keys                                   The taproot output public keys.
 153 | + * @param labels                                            The recipient's labels.
 154 | + * @return std::<optional<std::vector<SilentPaymentOutput>> The found outputs, nullopt if none found.
 155 | + */
 156 | +std::optional<std::vector<SilentPaymentOutput>> ScanForSilentPaymentOutputs(const CKey& scan_key, const PrevoutsSummary& prevouts_summary, const CPubKey& spend_pubkey, const std::vector<XOnlyPubKey>& output_pub_keys, const std::map<CPubKey, uint256>& labels);

---

 206 | +    generated_output_ptrs.reserve(recipients.size());
 207 | +
 208 | +    for (size_t i = 0; i < recipients.size(); i++) {
 209 | +        secp256k1_silentpayments_recipient recipient_obj;
 210 | +        ret = secp256k1_ec_pubkey_parse(secp256k1_context_static, &recipient_obj.scan_pubkey, recipients[i].m_scan_pubkey.data(), recipients[i].m_scan_pubkey.size());
 211 | +        ret = secp256k1_ec_pubkey_parse(secp256k1_context_static, &recipient_obj.spend_pubkey, recipients[i].m_spend_pubkey.data(), recipients[i].m_spend_pubkey.size());

---

 331 | +        secp256k1_silentpayments_found_output found_output{};
 332 | +        secp256k1_xonly_pubkey tx_output_obj;
 333 | +        found_output_objs.push_back(found_output);
 334 | +        found_output_ptrs.push_back(&found_output_objs[i]);
 335 | +        ret = secp256k1_xonly_pubkey_parse(secp256k1_context_static, &tx_output_obj, tx_outputs[i].data());
 336 | +        assert(ret);

---

  27 | +namespace bip352 {
  28 | +
  29 | +class PrevoutsSummaryImpl
  30 | +{
  31 | +private:
  32 | +    //! The actual secnonce itself

---

 158 | @@ -140,7 +159,7 @@ struct PayToAnchor : public WitnessUnknown
 159 |   *  * WitnessUnknown: TxoutType::WITNESS_UNKNOWN destination (P2W??? address)
 160 |   *  A CTxDestination is the internal data type encoded in a bitcoin address
 161 |   */
 162 | -using CTxDestination = std::variant<CNoDestination, PubKeyDestination, PKHash, ScriptHash, WitnessV0ScriptHash, WitnessV0KeyHash, WitnessV1Taproot, PayToAnchor, WitnessUnknown>;
 163 | +using CTxDestination = std::variant<CNoDestination, V0SilentPaymentDestination, PubKeyDestination, PKHash, ScriptHash, WitnessV0ScriptHash, WitnessV0KeyHash, WitnessV1Taproot, PayToAnchor, WitnessUnknown>;

---

  36 | @@ -37,6 +37,7 @@ enum class Encoding {
  37 |   *  and we would never encode an address with such a massive value */
  38 |  enum CharLimit : size_t {
  39 |      BECH32 = 90,            //!< BIP173/350 imposed character limit for Bech32(m) encoded addresses. This guarantees finding up to 4 errors.
  40 | +    SILENT_PAYMENTS = 1024, //!< BIP352 imposed 1024 character limit on Bech32m encoded silent payment addresses. This guarantees finding up to 3 errors

---

 112 | @@ -113,6 +113,7 @@ class CChainParams
 113 |      const std::vector<std::string>& DNSSeeds() const { return vSeeds; }
 114 |      const std::vector<unsigned char>& Base58Prefix(Base58Type type) const { return base58Prefixes[type]; }
 115 |      const std::string& Bech32HRP() const { return bech32_hrp; }
 116 | +    const std::string& SilentPaymentHRP() const { return silent_payment_hrp; }

---

 174 | +                error_str = strprintf("Silent payment version is v0 but data is not the correct size (expected %d, got %d).", SILENT_PAYMENT_V0_DATA_SIZE, data.size());
 175 | +                return CNoDestination();
 176 | +            }
 177 | +            CPubKey scan_pubkey{data.begin(), data.begin() + CPubKey::COMPRESSED_SIZE};
 178 | +            CPubKey spend_pubkey{data.begin() + CPubKey::COMPRESSED_SIZE, data.begin() + 2*CPubKey::COMPRESSED_SIZE};
 179 | +            return V0SilentPaymentDestination{scan_pubkey, spend_pubkey};

---

   0 | @@ -0,0 +1,2760 @@
   1 | +[

---

  77 | +    } else if (type == TxoutType::WITNESS_V0_KEYHASH && !txin.scriptWitness.stack.empty()) {
  78 | +        // We ensure the witness stack is not empty before exctracting the public key
  79 | +        // since there are scenarios where it can be, e.g., before the transaction has been signed.
  80 | +        //
  81 | +        // TODO: having this check here feels a bit hacky, will revisit with a more comprehensive solution
  82 | +        pubkey = CPubKey{txin.scriptWitness.stack.back()};

---

  75 | +        data_in.reserve(66);
  76 | +        // Set 0 as the silent payments version
  77 | +        std::vector<unsigned char> data_out = {0};
  78 | +        // ConvertBits will expand each 8-bit byte into 5-bit chunks,
  79 | +        // i.e. (67 * 8 / 5) = 107.2 -> so we reserve 108
  80 | +        data_out.reserve(108);

---

  89 | +            const std::vector<UniValue>& silent_payment_addresses = given["recipients"].getValues();
  90 | +            for (size_t i = 0; i < silent_payment_addresses.size(); ++i) {
  91 | +                const CTxDestination& tx_dest = DecodeDestination(silent_payment_addresses[i].get_str());
  92 | +                if (const auto* sp = std::get_if<V0SilentPaymentDestination>(&tx_dest)) {
  93 | +                    sp_dests[i] = *sp;
  94 | +                }

---

  32 | +    key.SetSeed(seed);
  33 | +    for (auto index : path) {
  34 | +        BOOST_CHECK(key.Derive(key, index));
  35 | +    }
  36 | +    return key.key;
  37 | +}

---