diff --git a/PARITY.md b/PARITY.md index 74a0e5c..684db2d 100644 --- a/PARITY.md +++ b/PARITY.md @@ -339,14 +339,38 @@ the messenger rather than staying separate apps. | Local vault: add, organise, delete | βšͺ | | Bell–LaPadula labels and clearance | βšͺ | | Share a file into a chat or group | βšͺ | +| Wallet engine: BIP-39, Base58, SLIP-0010 | 🟑 primitives built and pinned to the published vectors; no screen yet | | Wallet: BIP-39 seed, create and restore | βšͺ | | Wallet: fresh receive address per receive | βšͺ | | Wallet: balance and transactions from a node | βšͺ | -⚠️ Nothing here exists on Android yet. The iOS side is built and tested; the -engine work it rests on (BIP-39, SLIP-0010, Base58, the label encoding) is -Swift-only and has no Kotlin counterpart, so this is the largest remaining gap -and it is a build, not a port of a screen. +⚠️ Nothing above the engine exists on Android yet. This is the largest +remaining gap and it is a build, not a port of a screen. + +πŸ”΄ **The wallet primitives are now in Kotlin and pinned to the STANDARDS, not to +the Swift engine.** `Bip39`, `Base58` and `HdKey` are held to BIP-39's own +vectors, SLIP-0010's own ed25519 vectors and the published word-list SHA-256 β€” +the same things the Swift side is held to. Checking one implementation against +the other would only prove they agree, and two implementations agreeing on the +wrong answer is exactly how a wallet ends up empty: a phrase written down on an +iPhone has to restore on an Android handset, and on somebody else's software +years from now. + +Every failure in that file is silent in production. A wrong checksum bit, a lost +leading zero, a missed NFKD β€” none of them error. They derive a different, +perfectly valid, empty wallet. + +Two Kotlin-specific decisions, both money-relevant: + +- **PBKDF2 is hand-written over `Mac`**, not `SecretKeyFactory`. The JCA path + takes a `CharArray` and the provider decides the encoding β€” `AccountKdf` + already carries that caveat for the account KDF. For a wallet the consequence + is worse than a failed sign-in: a phrase containing anything outside ASCII + would stretch differently under a different provider and derive a different + empty wallet with no error anywhere. +- **Base58 is a digit loop, not `BigInteger`.** The obvious Kotlin version is + `BigInteger(1, bytes).toString(58)` remapped, and it silently drops leading + zero bytes β€” encoding two different keys to one address. --- diff --git a/engine/src/main/kotlin/io/flamenet/e2e/Base58.kt b/engine/src/main/kotlin/io/flamenet/e2e/Base58.kt new file mode 100644 index 0000000..7365e8f --- /dev/null +++ b/engine/src/main/kotlin/io/flamenet/e2e/Base58.kt @@ -0,0 +1,82 @@ +package io.flamenet.e2e + +/** + * Base58, the alphabet every ed25519 chain prints addresses in. + * + * ⚠️ **The leading-zero rule is the whole difficulty.** Base58 is + * base-conversion of one big integer, and an integer has no way to represent a + * leading zero byte β€” so the standard prepends one `1` per leading zero byte + * separately. Implementations that forget this encode two different keys to the + * same string, and the failure surfaces as money sent to the wrong address. + * Hence the tests, which are mostly about zeros. + * + * πŸ”΄ **Hand-written rather than `java.math.BigInteger`.** The obvious Kotlin + * implementation is `BigInteger(1, bytes).toString(58)` with a remapped + * alphabet, and it is wrong in exactly the way above: `BigInteger` discards + * leading zeros, so a key beginning `0x00` loses a character and encodes to + * another key's address. The digit loop below is the same one the Swift engine + * runs, so the two cannot disagree. + */ +object Base58 { + + /** + * πŸ”΄ Not the Bitcoin alphabet's cousins: `0`, `O`, `I` and `l` are absent + * deliberately, so an address read aloud or copied by hand cannot become a + * different valid one. + */ + const val ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz" + + private val VALUES: Map = + ALPHABET.withIndex().associate { (index, character) -> character to index } + + fun encode(data: ByteArray): String { + if (data.isEmpty()) return "" + // πŸ”΄ Starts EMPTY, not with a zero digit. Seeded with one, an all-zero + // input produces one digit AND one leading '1', so a single 0x00 byte + // encodes as "11" β€” every address with a leading zero comes out one + // character too long, and is either rejected by the other end or, + // worse, accepted as a different one. + val digits = ArrayList() + for (byte in data) { + var carry = byte.toInt() and 0xff + for (position in digits.indices) { + carry += digits[position] shl 8 + digits[position] = carry % 58 + carry /= 58 + } + while (carry > 0) { + digits.add(carry % 58) + carry /= 58 + } + } + // One '1' per leading zero byte β€” see the note above. + val leadingZeros = data.takeWhile { it.toInt() == 0 }.count() + return "1".repeat(leadingZeros) + + digits.reversed().map { ALPHABET[it] }.joinToString("") + } + + /** + * Null for any character outside the alphabet, rather than a best guess: a + * mistyped address must fail here, not resolve to somebody else's. + */ + fun decode(text: String): ByteArray? { + if (text.isEmpty()) return ByteArray(0) + val bytes = ArrayList() + for (character in text) { + var carry = VALUES[character] ?: return null + for (position in bytes.indices) { + carry += bytes[position] * 58 + bytes[position] = carry and 0xff + carry = carry shr 8 + } + while (carry > 0) { + bytes.add(carry and 0xff) + carry = carry shr 8 + } + } + val leadingOnes = text.takeWhile { it == '1' }.count() + val out = ByteArray(leadingOnes + bytes.size) + for (i in bytes.indices) out[leadingOnes + i] = bytes[bytes.size - 1 - i].toByte() + return out + } +} diff --git a/engine/src/main/kotlin/io/flamenet/e2e/Bip39.kt b/engine/src/main/kotlin/io/flamenet/e2e/Bip39.kt new file mode 100644 index 0000000..417e51e --- /dev/null +++ b/engine/src/main/kotlin/io/flamenet/e2e/Bip39.kt @@ -0,0 +1,216 @@ +package io.flamenet.e2e + +import java.security.MessageDigest +import java.text.Normalizer +import javax.crypto.Mac +import javax.crypto.spec.SecretKeySpec + +/** + * BIP-39 mnemonics, for the wallet only. + * + * πŸ”΄ **Not for anything else here.** Files recovers through its own Crockford + * codes, and the reasoning for rejecting a word list there stands: 2,048 + * entries that must be byte-exact is a footgun. The wallet accepts that footgun + * for one reason β€” a phrase has to be understood by software nobody here + * controls β€” and pays for it with [verify]. + * + * A port of `Packages/FlamenetFiles/Sources/FilesEngine/BIP39.swift`, asserted + * against the same published vectors so the two cannot drift into deriving + * different wallets from one phrase. The vendored word list is byte-identical + * to the iOS one and has the same SHA-256. + */ +object Bip39 { + + sealed class Failure(message: String) : Exception(message) { + class BadEntropySize(val size: Int) : + Failure("Entropy must be 16, 20, 24, 28 or 32 bytes, not $size.") + class BadPhraseLength(val words: Int) : + Failure("A recovery phrase is 12, 15, 18, 21 or 24 words, not $words.") + class UnknownWord(val word: String) : + Failure("β€œ$word” is not a recovery phrase word.") + object ChecksumFailed : + Failure("That phrase does not check out β€” look for a mistyped word.") + class WordlistDigestMismatch(val found: String) : + Failure("The word list does not match its published fingerprint.") + class WordlistWrongLength(val count: Int) : + Failure("A word list has exactly 2048 words, not $count.") + } + + /** + * The published SHA-256 of the BIP-39 English word list. + * + * ⚠️ Wrong here fails CLOSED β€” a correct list would be rejected and nothing + * would derive, which is the safe direction to be wrong in. + */ + const val ENGLISH_DIGEST = "2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda" + + /** + * πŸ”΄ The whole mitigation. A silently corrupted list does not error β€” it + * produces a DIFFERENT wallet from the same phrase, and the way somebody + * finds out is restoring and seeing an empty account. + */ + fun verify(words: List, digest: String = ENGLISH_DIGEST) { + if (words.size != 2048) throw Failure.WordlistWrongLength(words.size) + val canonical = words.joinToString("\n") + "\n" + val hex = MessageDigest.getInstance("SHA-256") + .digest(canonical.toByteArray(Charsets.UTF_8)) + .joinToString("") { "%02x".format(it) } + if (hex != digest) throw Failure.WordlistDigestMismatch(hex) + } + + private val PERMITTED = mapOf(16 to 12, 20 to 15, 24 to 18, 28 to 21, 32 to 24) + + /** + * Entropy to phrase. The checksum is the first `entropy.size / 4` bits of + * SHA-256(entropy), which is what makes a mistyped word fail rather than + * silently name another wallet. + */ + fun phrase(entropy: ByteArray, words: List): String { + if (!PERMITTED.containsKey(entropy.size)) throw Failure.BadEntropySize(entropy.size) + val checksum = MessageDigest.getInstance("SHA-256").digest(entropy) + val bits = StringBuilder() + for (b in entropy) bits.append(bitsOf(b)) + for (b in checksum) bits.append(bitsOf(b)) + val used = bits.substring(0, entropy.size * 8 + entropy.size / 4) + + val out = ArrayList() + var index = 0 + while (index < used.length) { + out.add(words[used.substring(index, index + 11).toInt(2)]) + index += 11 + } + return out.joinToString(" ") + } + + /** + * Phrase back to entropy, refusing anything that does not check out. + * + * ⚠️ Every failure is loud. A phrase of the wrong length, containing a word + * not on the list, or failing its checksum is rejected β€” never coerced into + * the nearest valid thing, which would hand somebody a wallet not theirs. + */ + fun entropy(phrase: String, words: List): ByteArray { + val given = normalise(phrase).trim().split(Regex("\\s+")).filter { it.isNotEmpty() } + if (given.size !in listOf(12, 15, 18, 21, 24)) throw Failure.BadPhraseLength(given.size) + + val lookup = HashMap(words.size * 2) + words.forEachIndexed { at, word -> lookup[word] = at } + + val bits = StringBuilder() + for (word in given) { + val at = lookup[word] ?: throw Failure.UnknownWord(word) + bits.append(at.toString(2).padStart(11, '0')) + } + + val entropyBits = given.size * 11 * 32 / 33 + val entropy = ByteArray(entropyBits / 8) + for (i in entropy.indices) { + entropy[i] = bits.substring(i * 8, i * 8 + 8).toInt(2).toByte() + } + val expected = MessageDigest.getInstance("SHA-256").digest(entropy) + .joinToString("") { bitsOf(it) } + val carried = bits.substring(entropyBits) + if (carried != expected.substring(0, entropyBits / 32)) throw Failure.ChecksumFailed + return entropy + } + + /** + * Phrase to the 64-byte seed everything derives from. + * + * ⚠️ The optional passphrase is BIP-39's, not the account's. A different one + * silently yields a DIFFERENT valid wallet β€” the standard's design, and a + * sharp edge worth naming wherever it is offered to somebody. + */ + fun seed(phrase: String, passphrase: String = ""): ByteArray = + pbkdf2HmacSha512( + password = normalise(phrase).toByteArray(Charsets.UTF_8), + salt = normalise("mnemonic$passphrase").toByteArray(Charsets.UTF_8), + iterations = 2048, + length = 64, + ) + + /** + * The vendored list, read from the module's resources. + * + * πŸ”΄ Verified on every load rather than once at build. The file ships inside + * the app, and a check that only ran in CI would not notice one that + * arrived corrupted. + */ + fun englishWordlist(): List { + val stream = Bip39::class.java.getResourceAsStream("english.txt") + ?: throw Failure.WordlistWrongLength(0) + val words = stream.bufferedReader(Charsets.UTF_8).use { it.readText() } + .trim().split("\n").map { it.trim() }.filter { it.isNotEmpty() } + verify(words) + return words + } + + // ---- Internals ------------------------------------------------------- + + private fun bitsOf(b: Byte): String = + (b.toInt() and 0xff).toString(2).padStart(8, '0') + + /** + * πŸ”΄ **NFKD, and it decides which wallet you get.** BIP-39 normalises the + * phrase and the salt before stretching. A phrase typed with composed + * accents and one typed with combining marks are the same words to a + * reader and different bytes to PBKDF2 β€” so skipping this derives a + * different, perfectly valid, empty wallet. + */ + private fun normalise(text: String): String = + Normalizer.normalize(text, Normalizer.Form.NFKD) + + /** + * PBKDF2-HMAC-SHA512. + * + * πŸ”΄ **Hand-written on top of [Mac] rather than through + * `SecretKeyFactory("PBKDF2WithHmacSHA512")`, and the reason is money.** + * The JCA path takes a `CharArray` and the provider decides how to encode + * it β€” `AccountKdf.master` already carries a note about that for the + * account KDF, where the same ambiguity exists. For a wallet the + * consequence is worse than a failed sign-in: a phrase containing anything + * outside ASCII would stretch to different bytes under a different + * provider, and derive a different wallet that is empty and perfectly + * valid, with no error anywhere. Taking the bytes ourselves removes the + * provider from the decision entirely. + * + * ⚠️ Also: `PBKDF2WithHmacSHA512` is absent on Android below API 26, and + * this engine's floor is lower than the rest of the app's for a reason β€” + * the JVM tests run it with no emulator. + */ + internal fun pbkdf2HmacSha512( + password: ByteArray, + salt: ByteArray, + iterations: Int, + length: Int, + ): ByteArray { + val mac = Mac.getInstance("HmacSHA512") + mac.init(SecretKeySpec(password, "HmacSHA512")) + val blockSize = mac.macLength + val out = ByteArray(length) + var written = 0 + var block = 1 + while (written < length) { + mac.reset() + mac.update(salt) + mac.update(byteArrayOf( + (block ushr 24).toByte(), (block ushr 16).toByte(), + (block ushr 8).toByte(), block.toByte(), + )) + var u = mac.doFinal() + val accumulated = u.copyOf() + for (round in 2..iterations) { + mac.reset() + u = mac.doFinal(u) + for (i in accumulated.indices) { + accumulated[i] = (accumulated[i].toInt() xor u[i].toInt()).toByte() + } + } + val take = minOf(blockSize, length - written) + System.arraycopy(accumulated, 0, out, written, take) + written += take + block++ + } + return out + } +} diff --git a/engine/src/main/kotlin/io/flamenet/e2e/HdKey.kt b/engine/src/main/kotlin/io/flamenet/e2e/HdKey.kt new file mode 100644 index 0000000..69ac7f1 --- /dev/null +++ b/engine/src/main/kotlin/io/flamenet/e2e/HdKey.kt @@ -0,0 +1,124 @@ +package io.flamenet.e2e + +import javax.crypto.Mac +import javax.crypto.spec.SecretKeySpec + +/** + * Hierarchical key derivation from a wallet seed. SLIP-0010, ed25519 curve. + * + * πŸ”΄ **Addresses are independent of who you are, by construction.** The seed is + * fresh entropy, never derived from the passphrase, the account name, or the + * Flamenet identity β€” so no address can be computed from a Flamenet identity + * and no identity from an address. This type only walks a tree downward from + * that seed; nothing identifying is ever an input, and nothing here should ever + * be given one. + * + * ⚠️ **Fresh key per use, not one address reused.** The tree exists so an + * ordinary path β€” `m/44H/501H/accountH/0H` β€” yields a new keypair per receive + * without new backup material: the phrase still restores all of them. Reusing a + * single address would tie every payment together on a public ledger for + * anybody who cared to look, which is a privacy property the wallet can control + * and the chain cannot. + * + * πŸ”΄ **ed25519 only, and hardened only.** SLIP-0010 defines no non-hardened + * derivation for this curve β€” the public key is a compressed Edwards point with + * no usable additive homomorphism β€” so [derive] refuses an unhardened index + * rather than inventing a scheme. secp256k1 chains need curve arithmetic this + * engine does not carry; supporting them is a dependency decision, not + * something to approximate here. + */ +data class HdKey( + /** 32 bytes. The ed25519 scalar seed, not an expanded secret. */ + val privateKey: ByteArray, + /** 32 bytes. Feeds the next derivation, never a key on its own. */ + val chainCode: ByteArray, +) { + // ⚠️ ByteArray has reference equality, and a data class inherits it. Two + // keys derived from one path down two objects must compare equal or every + // test here asserts nothing. + override fun equals(other: Any?) = other is HdKey && + privateKey.contentEquals(other.privateKey) && chainCode.contentEquals(other.chainCode) + + override fun hashCode() = 31 * privateKey.contentHashCode() + chainCode.contentHashCode() + + sealed class Failure(message: String) : Exception(message) { + class SeedOutOfRange(val size: Int) : Failure("That wallet seed is the wrong size.") + class Unhardened(val index: Long) : Failure("This wallet only derives hardened keys.") + class MalformedPath(val path: String) : Failure("$path isn't a derivation path.") + } + + /** One hardened step. [index] may be given with or without the flag set. */ + fun derive(index: Long): HdKey { + val hardenedIndex = if (index >= HARDENED) index else index or HARDENED + if (hardenedIndex < HARDENED) throw Failure.Unhardened(index) + + // 0x00 || private key || index, big-endian. The leading zero is what + // distinguishes this from the secp256k1 layout and is part of the + // standard, not padding. + val data = ByteArray(1 + 32 + 4) + data[0] = 0 + System.arraycopy(privateKey, 0, data, 1, 32) + data[33] = (hardenedIndex ushr 24).toByte() + data[34] = (hardenedIndex ushr 16).toByte() + data[35] = (hardenedIndex ushr 8).toByte() + data[36] = hardenedIndex.toByte() + + val bytes = hmacSha512(key = chainCode, data = data) + return HdKey(bytes.copyOfRange(0, 32), bytes.copyOfRange(32, 64)) + } + + /** + * Walk a path such as `m/44H/501H/0H/0H`. + * + * ⚠️ Accepts `H`, `h` and `'` for hardened, because all three are written + * in the wild and a path copied from documentation should not fail on + * notation. An index with none of them is REFUSED rather than silently + * hardened: somebody writing `m/44` means non-hardened, which this curve + * cannot do, and quietly giving them a different key than every other + * wallet would is the worst possible answer. + */ + fun derive(path: String): HdKey { + val components = path.split("/").filter { it.isNotEmpty() }.toMutableList() + if (components.firstOrNull()?.lowercase() == "m") components.removeAt(0) + var key = this + for (component in components) { + if (!(component.endsWith("H") || component.endsWith("h") || component.endsWith("'"))) { + throw Failure.Unhardened(0) + } + val index = component.dropLast(1).toLongOrNull() + ?: throw Failure.MalformedPath(path) + if (index < 0 || index >= HARDENED) throw Failure.MalformedPath(path) + key = key.derive(index) + } + return key + } + + companion object { + /** SLIP-0010 fixes this string; changing it changes every key. */ + private val CURVE = "ed25519 seed".toByteArray(Charsets.UTF_8) + + /** Anything at or above this is hardened. */ + const val HARDENED: Long = 0x8000_0000L + + /** The master key. SLIP-0010 Β§Master key generation. */ + fun master(seed: ByteArray): HdKey { + // The standard's own bound. BIP-39 gives 64, so this only fires on + // a caller that built a seed some other way. + if (seed.size !in 16..64) throw Failure.SeedOutOfRange(seed.size) + val bytes = hmacSha512(key = CURVE, data = seed) + // ⚠️ ed25519 needs no retry loop. On secp256k1 an IL of zero or β‰₯ n + // is re-hashed; every 32-byte string is a valid ed25519 scalar seed, + // so there is no such case and adding one would be dead code that + // looks load-bearing. + return HdKey(bytes.copyOfRange(0, 32), bytes.copyOfRange(32, 64)) + } + + fun master(seed: ByteArray, path: String): HdKey = master(seed).derive(path) + + private fun hmacSha512(key: ByteArray, data: ByteArray): ByteArray { + val mac = Mac.getInstance("HmacSHA512") + mac.init(SecretKeySpec(key, "HmacSHA512")) + return mac.doFinal(data) + } + } +} diff --git a/engine/src/main/resources/io/flamenet/e2e/english.txt b/engine/src/main/resources/io/flamenet/e2e/english.txt new file mode 100644 index 0000000..942040e --- /dev/null +++ b/engine/src/main/resources/io/flamenet/e2e/english.txt @@ -0,0 +1,2048 @@ +abandon +ability +able +about +above +absent +absorb +abstract +absurd +abuse +access +accident +account +accuse +achieve +acid +acoustic +acquire +across +act +action +actor +actress +actual +adapt +add +addict +address +adjust +admit +adult +advance +advice +aerobic +affair +afford +afraid +again +age +agent +agree +ahead +aim +air +airport +aisle +alarm +album +alcohol +alert +alien +all +alley +allow +almost +alone +alpha +already +also +alter +always +amateur +amazing +among +amount +amused +analyst +anchor +ancient +anger +angle +angry +animal +ankle +announce +annual +another +answer +antenna +antique +anxiety +any +apart +apology +appear +apple +approve +april +arch +arctic +area +arena +argue +arm +armed +armor +army +around +arrange +arrest +arrive +arrow +art +artefact +artist +artwork +ask +aspect +assault +asset +assist +assume +asthma +athlete +atom +attack +attend +attitude +attract +auction +audit +august +aunt +author +auto +autumn +average +avocado +avoid +awake +aware +away +awesome +awful +awkward +axis +baby +bachelor +bacon +badge +bag +balance +balcony +ball +bamboo +banana +banner +bar +barely +bargain +barrel +base +basic +basket +battle +beach +bean +beauty +because +become +beef +before +begin +behave +behind +believe +below +belt +bench +benefit +best +betray +better +between +beyond +bicycle +bid +bike +bind +biology +bird +birth +bitter +black +blade +blame +blanket +blast +bleak +bless +blind +blood +blossom +blouse +blue +blur +blush +board +boat +body +boil +bomb +bone +bonus +book +boost +border +boring +borrow +boss +bottom +bounce +box +boy +bracket +brain +brand +brass +brave +bread +breeze +brick +bridge +brief +bright +bring +brisk +broccoli +broken +bronze +broom +brother +brown +brush +bubble +buddy +budget +buffalo +build +bulb +bulk +bullet +bundle +bunker +burden +burger +burst +bus +business +busy +butter +buyer +buzz +cabbage +cabin +cable +cactus +cage +cake +call +calm +camera +camp +can +canal +cancel +candy +cannon +canoe +canvas +canyon +capable +capital +captain +car +carbon +card +cargo +carpet +carry +cart +case +cash +casino +castle +casual +cat +catalog +catch +category +cattle +caught +cause +caution +cave +ceiling +celery +cement +census +century +cereal +certain +chair +chalk +champion +change +chaos +chapter +charge +chase +chat +cheap +check +cheese +chef +cherry +chest +chicken +chief +child +chimney +choice +choose +chronic +chuckle +chunk +churn +cigar +cinnamon +circle +citizen +city +civil +claim +clap +clarify +claw +clay +clean +clerk +clever +click +client +cliff +climb +clinic +clip +clock +clog +close +cloth +cloud +clown +club +clump +cluster +clutch +coach +coast +coconut +code +coffee +coil +coin +collect +color +column +combine +come +comfort +comic +common +company +concert +conduct +confirm +congress +connect +consider +control +convince +cook +cool +copper +copy +coral +core +corn +correct +cost +cotton +couch +country +couple +course +cousin +cover +coyote +crack +cradle +craft +cram +crane +crash +crater +crawl +crazy +cream +credit +creek +crew +cricket +crime +crisp +critic +crop +cross +crouch +crowd +crucial +cruel +cruise +crumble +crunch +crush +cry +crystal +cube +culture +cup +cupboard +curious +current +curtain +curve +cushion +custom +cute +cycle +dad +damage +damp +dance +danger +daring +dash +daughter +dawn +day +deal +debate +debris +decade +december +decide +decline +decorate +decrease +deer +defense +define +defy +degree +delay +deliver +demand +demise +denial +dentist +deny +depart +depend +deposit +depth +deputy +derive +describe +desert +design +desk +despair +destroy +detail +detect +develop +device +devote +diagram +dial +diamond +diary +dice +diesel +diet +differ +digital +dignity +dilemma +dinner +dinosaur +direct +dirt +disagree +discover +disease +dish +dismiss +disorder +display +distance +divert +divide +divorce +dizzy +doctor +document +dog +doll +dolphin +domain +donate +donkey +donor +door +dose +double +dove +draft +dragon +drama +drastic +draw +dream +dress +drift +drill +drink +drip +drive +drop +drum +dry +duck +dumb +dune +during +dust +dutch +duty +dwarf +dynamic +eager +eagle +early +earn +earth +easily +east +easy +echo +ecology +economy +edge +edit +educate +effort +egg +eight +either +elbow +elder +electric +elegant +element +elephant +elevator +elite +else +embark +embody +embrace +emerge +emotion +employ +empower +empty +enable +enact +end +endless +endorse +enemy +energy +enforce +engage +engine +enhance +enjoy +enlist +enough +enrich +enroll +ensure +enter +entire +entry +envelope +episode +equal +equip +era +erase +erode +erosion +error +erupt +escape +essay +essence +estate +eternal +ethics +evidence +evil +evoke +evolve +exact +example +excess +exchange +excite +exclude +excuse +execute +exercise +exhaust +exhibit +exile +exist +exit +exotic +expand +expect +expire +explain +expose +express +extend +extra +eye +eyebrow +fabric +face +faculty +fade +faint +faith +fall +false +fame +family +famous +fan +fancy +fantasy +farm +fashion +fat +fatal +father +fatigue +fault +favorite +feature +february +federal +fee +feed +feel +female +fence +festival +fetch +fever +few +fiber +fiction +field +figure +file +film +filter +final +find +fine +finger +finish +fire +firm +first +fiscal +fish +fit +fitness +fix +flag +flame +flash +flat +flavor +flee +flight +flip +float +flock +floor +flower +fluid +flush +fly +foam +focus +fog +foil +fold +follow +food +foot +force +forest +forget +fork +fortune +forum +forward +fossil +foster +found +fox +fragile +frame +frequent +fresh +friend +fringe +frog +front +frost +frown +frozen +fruit +fuel +fun +funny +furnace +fury +future +gadget +gain +galaxy +gallery +game +gap +garage +garbage +garden +garlic +garment +gas +gasp +gate +gather +gauge +gaze +general +genius +genre +gentle +genuine +gesture +ghost +giant +gift +giggle +ginger +giraffe +girl +give +glad +glance +glare +glass +glide +glimpse +globe +gloom +glory +glove +glow +glue +goat +goddess +gold +good +goose +gorilla +gospel +gossip +govern +gown +grab +grace +grain +grant +grape +grass +gravity +great +green +grid +grief +grit +grocery +group +grow +grunt +guard +guess +guide +guilt +guitar +gun +gym +habit +hair +half +hammer +hamster +hand +happy +harbor +hard +harsh +harvest +hat +have +hawk +hazard +head +health +heart +heavy +hedgehog +height +hello +helmet +help +hen +hero +hidden +high +hill +hint +hip +hire +history +hobby +hockey +hold +hole +holiday +hollow +home +honey +hood +hope +horn +horror +horse +hospital +host +hotel +hour +hover +hub +huge +human +humble +humor +hundred +hungry +hunt +hurdle +hurry +hurt +husband +hybrid +ice +icon +idea +identify +idle +ignore +ill +illegal +illness +image +imitate +immense +immune +impact +impose +improve +impulse +inch +include +income +increase +index +indicate +indoor +industry +infant +inflict +inform +inhale +inherit +initial +inject +injury +inmate +inner +innocent +input +inquiry +insane +insect +inside +inspire +install +intact +interest +into +invest +invite +involve +iron +island +isolate +issue +item +ivory +jacket +jaguar +jar +jazz +jealous +jeans +jelly +jewel +job +join +joke +journey +joy +judge +juice +jump +jungle +junior +junk +just +kangaroo +keen +keep +ketchup +key +kick +kid +kidney +kind +kingdom +kiss +kit +kitchen +kite +kitten +kiwi +knee +knife +knock +know +lab +label +labor +ladder +lady +lake +lamp +language +laptop +large +later +latin +laugh +laundry +lava +law +lawn +lawsuit +layer +lazy +leader +leaf +learn +leave +lecture +left +leg +legal +legend +leisure +lemon +lend +length +lens +leopard +lesson +letter +level +liar +liberty +library +license +life +lift +light +like +limb +limit +link +lion +liquid +list +little +live +lizard +load +loan +lobster +local +lock +logic +lonely +long +loop +lottery +loud +lounge +love +loyal +lucky +luggage +lumber +lunar +lunch +luxury +lyrics +machine +mad +magic +magnet +maid +mail +main +major +make +mammal +man +manage +mandate +mango +mansion +manual +maple +marble +march +margin +marine +market +marriage +mask +mass +master +match +material +math +matrix +matter +maximum +maze +meadow +mean +measure +meat +mechanic +medal +media +melody +melt +member +memory +mention +menu +mercy +merge +merit +merry +mesh +message +metal +method +middle +midnight +milk +million +mimic +mind +minimum +minor +minute +miracle +mirror +misery +miss +mistake +mix +mixed +mixture +mobile +model +modify +mom +moment +monitor +monkey +monster +month +moon +moral +more +morning +mosquito +mother +motion +motor +mountain +mouse +move +movie +much +muffin +mule +multiply +muscle +museum +mushroom +music +must +mutual +myself +mystery +myth +naive +name +napkin +narrow +nasty +nation +nature +near +neck +need +negative +neglect +neither +nephew +nerve +nest +net +network +neutral +never +news +next +nice +night +noble +noise +nominee +noodle +normal +north +nose +notable +note +nothing +notice +novel +now +nuclear +number +nurse +nut +oak +obey +object +oblige +obscure +observe +obtain +obvious +occur +ocean +october +odor +off +offer +office +often +oil +okay +old +olive +olympic +omit +once +one +onion +online +only +open +opera +opinion +oppose +option +orange +orbit +orchard +order +ordinary +organ +orient +original +orphan +ostrich +other +outdoor +outer +output +outside +oval +oven +over +own +owner +oxygen +oyster +ozone +pact +paddle +page +pair +palace +palm +panda +panel +panic +panther +paper +parade +parent +park +parrot +party +pass +patch +path +patient +patrol +pattern +pause +pave +payment +peace +peanut +pear +peasant +pelican +pen +penalty +pencil +people +pepper +perfect +permit +person +pet +phone +photo +phrase +physical +piano +picnic +picture +piece +pig +pigeon +pill +pilot +pink +pioneer +pipe +pistol +pitch +pizza +place +planet +plastic +plate +play +please +pledge +pluck +plug +plunge +poem +poet +point +polar +pole +police +pond +pony +pool +popular +portion +position +possible +post +potato +pottery +poverty +powder +power +practice +praise +predict +prefer +prepare +present +pretty +prevent +price +pride +primary +print +priority +prison +private +prize +problem +process +produce +profit +program +project +promote +proof +property +prosper +protect +proud +provide +public +pudding +pull +pulp +pulse +pumpkin +punch +pupil +puppy +purchase +purity +purpose +purse +push +put +puzzle +pyramid +quality +quantum +quarter +question +quick +quit +quiz +quote +rabbit +raccoon +race +rack +radar +radio +rail +rain +raise +rally +ramp +ranch +random +range +rapid +rare +rate +rather +raven +raw +razor +ready +real +reason +rebel +rebuild +recall +receive +recipe +record +recycle +reduce +reflect +reform +refuse +region +regret +regular +reject +relax +release +relief +rely +remain +remember +remind +remove +render +renew +rent +reopen +repair +repeat +replace +report +require +rescue +resemble +resist +resource +response +result +retire +retreat +return +reunion +reveal +review +reward +rhythm +rib +ribbon +rice +rich +ride +ridge +rifle +right +rigid +ring +riot +ripple +risk +ritual +rival +river +road +roast +robot +robust +rocket +romance +roof +rookie +room +rose +rotate +rough +round +route +royal +rubber +rude +rug +rule +run +runway +rural +sad +saddle +sadness +safe +sail +salad +salmon +salon +salt +salute +same +sample +sand +satisfy +satoshi +sauce +sausage +save +say +scale +scan +scare +scatter +scene +scheme +school +science +scissors +scorpion +scout +scrap +screen +script +scrub +sea +search +season +seat +second +secret +section +security +seed +seek +segment +select +sell +seminar +senior +sense +sentence +series +service +session +settle +setup +seven +shadow +shaft +shallow +share +shed +shell +sheriff +shield +shift +shine +ship +shiver +shock +shoe +shoot +shop +short +shoulder +shove +shrimp +shrug +shuffle +shy +sibling +sick +side +siege +sight +sign +silent +silk +silly +silver +similar +simple +since +sing +siren +sister +situate +six +size +skate +sketch +ski +skill +skin +skirt +skull +slab +slam +sleep +slender +slice +slide +slight +slim +slogan +slot +slow +slush +small +smart +smile +smoke +smooth +snack +snake +snap +sniff +snow +soap +soccer +social +sock +soda +soft +solar +soldier +solid +solution +solve +someone +song +soon +sorry +sort +soul +sound +soup +source +south +space +spare +spatial +spawn +speak +special +speed +spell +spend +sphere +spice +spider +spike +spin +spirit +split +spoil +sponsor +spoon +sport +spot +spray +spread +spring +spy +square +squeeze +squirrel +stable +stadium +staff +stage +stairs +stamp +stand +start +state +stay +steak +steel +stem +step +stereo +stick +still +sting +stock +stomach +stone +stool +story +stove +strategy +street +strike +strong +struggle +student +stuff +stumble +style +subject +submit +subway +success +such +sudden +suffer +sugar +suggest +suit +summer +sun +sunny +sunset +super +supply +supreme +sure +surface +surge +surprise +surround +survey +suspect +sustain +swallow +swamp +swap +swarm +swear +sweet +swift +swim +swing +switch +sword +symbol +symptom +syrup +system +table +tackle +tag +tail +talent +talk +tank +tape +target +task +taste +tattoo +taxi +teach +team +tell +ten +tenant +tennis +tent +term +test +text +thank +that +theme +then +theory +there +they +thing +this +thought +three +thrive +throw +thumb +thunder +ticket +tide +tiger +tilt +timber +time +tiny +tip +tired +tissue +title +toast +tobacco +today +toddler +toe +together +toilet +token +tomato +tomorrow +tone +tongue +tonight +tool +tooth +top +topic +topple +torch +tornado +tortoise +toss +total +tourist +toward +tower +town +toy +track +trade +traffic +tragic +train +transfer +trap +trash +travel +tray +treat +tree +trend +trial +tribe +trick +trigger +trim +trip +trophy +trouble +truck +true +truly +trumpet +trust +truth +try +tube +tuition +tumble +tuna +tunnel +turkey +turn +turtle +twelve +twenty +twice +twin +twist +two +type +typical +ugly +umbrella +unable +unaware +uncle +uncover +under +undo +unfair +unfold +unhappy +uniform +unique +unit +universe +unknown +unlock +until +unusual +unveil +update +upgrade +uphold +upon +upper +upset +urban +urge +usage +use +used +useful +useless +usual +utility +vacant +vacuum +vague +valid +valley +valve +van +vanish +vapor +various +vast +vault +vehicle +velvet +vendor +venture +venue +verb +verify +version +very +vessel +veteran +viable +vibrant +vicious +victory +video +view +village +vintage +violin +virtual +virus +visa +visit +visual +vital +vivid +vocal +voice +void +volcano +volume +vote +voyage +wage +wagon +wait +walk +wall +walnut +want +warfare +warm +warrior +wash +wasp +waste +water +wave +way +wealth +weapon +wear +weasel +weather +web +wedding +weekend +weird +welcome +west +wet +whale +what +wheat +wheel +when +where +whip +whisper +wide +width +wife +wild +will +win +window +wine +wing +wink +winner +winter +wire +wisdom +wise +wish +witness +wolf +woman +wonder +wood +wool +word +work +world +worry +worth +wrap +wreck +wrestle +wrist +write +wrong +yard +year +yellow +you +young +youth +zebra +zero +zone +zoo diff --git a/engine/src/test/kotlin/io/flamenet/e2e/WalletPrimitivesTest.kt b/engine/src/test/kotlin/io/flamenet/e2e/WalletPrimitivesTest.kt new file mode 100644 index 0000000..60e6a04 --- /dev/null +++ b/engine/src/test/kotlin/io/flamenet/e2e/WalletPrimitivesTest.kt @@ -0,0 +1,347 @@ +package io.flamenet.e2e + +import kotlin.test.Test +import kotlin.test.assertContentEquals +import kotlin.test.assertEquals +import kotlin.test.assertFailsWith +import kotlin.test.assertNotEquals +import kotlin.test.assertNull +import kotlin.test.assertTrue + +/** + * BIP-39, Base58 and SLIP-0010 against the published vectors. + * + * πŸ”΄ **These are pinned to the STANDARDS, not to the Swift engine.** Testing + * one implementation against the other proves only that they agree, and two + * implementations agreeing on the wrong answer is exactly how a wallet ends up + * empty: a phrase written down on an iPhone has to restore on an Android + * handset, and on somebody else's software years from now. So the vectors here + * are BIP-39's own, SLIP-0010's own, and the published word-list digest β€” which + * the Swift engine is also held to. + * + * ⚠️ **Every failure in this file is silent in production.** A wrong checksum + * bit, a lost leading zero, a missed NFKD: none of them error. They derive a + * different, perfectly valid, empty wallet, and the way somebody finds out is + * restoring their phrase and seeing nothing there. + */ +class WalletPrimitivesTest { + + private fun hex(bytes: ByteArray) = bytes.joinToString("") { "%02x".format(it) } + private fun unhex(text: String) = ByteArray(text.length / 2) { + text.substring(it * 2, it * 2 + 2).toInt(16).toByte() + } + + private val words by lazy { Bip39.englishWordlist() } + + // ---- The word list --------------------------------------------------- + + /** + * πŸ”΄ The whole mitigation for vendoring 2,048 strings. A silently corrupted + * list does not error β€” it produces a DIFFERENT wallet from the same + * phrase. + */ + @Test + fun `the vendored word list matches its published fingerprint`() { + assertEquals(2048, words.size) + Bip39.verify(words) + assertEquals("abandon", words.first()) + assertEquals("zoo", words.last()) + } + + @Test + fun `a corrupted word list is refused`() { + val tampered = words.toMutableList().also { it[7] = "banana" } + assertFailsWith { Bip39.verify(tampered) } + assertFailsWith { Bip39.verify(words.drop(1)) } + } + + // ---- BIP-39 vectors -------------------------------------------------- + + /** + * The canonical first vector from BIP-39's own test file: all-zero entropy. + */ + @Test + fun `all-zero entropy produces the canonical phrase and seed`() { + val entropy = ByteArray(16) + val phrase = Bip39.phrase(entropy, words) + assertEquals( + "abandon abandon abandon abandon abandon abandon abandon abandon " + + "abandon abandon abandon about", + phrase, + ) + assertContentEquals(entropy, Bip39.entropy(phrase, words)) + assertEquals( + "c55257c360c07c72029aebc1b53c05ed0362ada38ead3e3e9efa3708e5349553" + + "1f09a6987599d18264c1e1c92f2cf141630c7a3c4ab7c81b2f001698e7463b04", + hex(Bip39.seed(phrase, passphrase = "TREZOR")), + ) + } + + /** A 24-word vector, to exercise the longer checksum. */ + @Test + fun `the all-ones 32-byte vector round-trips`() { + val entropy = ByteArray(32) { 0xff.toByte() } + val phrase = Bip39.phrase(entropy, words) + assertEquals(24, phrase.split(" ").size) + assertEquals("zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo " + + "zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo vote", phrase) + assertContentEquals(entropy, Bip39.entropy(phrase, words)) + // ⚠️ This expectation was WRONG in the first version of this file β€” it + // carried the seed from a different BIP-39 vector, and the Kotlin + // answer below is the correct one. It was resolved by computing the + // value independently (PBKDF2-HMAC-SHA512, NFKD, 2048 rounds) rather + // than by adopting whatever the implementation produced, which is the + // only way a vector test is worth anything: a pinned value taken from + // the code under test pins the bug. + assertEquals( + "dd48c104698c30cfe2b6142103248622fb7bb0ff692eebb00089b32d22484e16" + + "13912f0a5b694407be899ffd31ed3992c456cdf60f5d4564b8ba3f05a69890ad", + hex(Bip39.seed(phrase, passphrase = "TREZOR")), + ) + } + + /** A mid-length vector, so 18 words is not left to inference. */ + @Test + fun `an eighteen-word vector round-trips`() { + val entropy = unhex("808080808080808080808080808080808080808080808080") + val phrase = Bip39.phrase(entropy, words) + assertEquals( + "letter advice cage absurd amount doctor acoustic avoid letter " + + "advice cage absurd amount doctor acoustic avoid letter always", + phrase, + ) + assertContentEquals(entropy, Bip39.entropy(phrase, words)) + } + + /** + * πŸ”΄ **The passphrase silently names a different wallet.** That is BIP-39's + * design, and it is the sharpest edge in the whole standard β€” somebody who + * mistypes it does not get an error, they get an empty account. + */ + @Test + fun `a different BIP-39 passphrase derives a different seed`() { + val phrase = Bip39.phrase(ByteArray(16), words) + assertNotEquals(hex(Bip39.seed(phrase)), hex(Bip39.seed(phrase, "TREZOR"))) + assertNotEquals(hex(Bip39.seed(phrase, "a")), hex(Bip39.seed(phrase, "A"))) + } + + // ---- BIP-39 refusals ------------------------------------------------- + + @Test + fun `a mistyped word is refused rather than resolved to a neighbour`() { + val phrase = Bip39.phrase(ByteArray(16), words).replace("about", "abut") + assertFailsWith { Bip39.entropy(phrase, words) } + } + + /** + * πŸ”΄ The checksum's whole job: a phrase of real words in a plausible order + * that is not a phrase anybody generated. + */ + @Test + fun `a phrase that fails its checksum is refused`() { + val phrase = Bip39.phrase(ByteArray(16), words).replace("about", "abandon") + assertFailsWith { Bip39.entropy(phrase, words) } + } + + @Test + fun `a phrase of the wrong length is refused`() { + val short = Bip39.phrase(ByteArray(16), words).split(" ").drop(1).joinToString(" ") + assertFailsWith { Bip39.entropy(short, words) } + } + + @Test + fun `entropy of a size the standard does not define is refused`() { + assertFailsWith { Bip39.phrase(ByteArray(15), words) } + assertFailsWith { Bip39.phrase(ByteArray(64), words) } + } + + /** ⚠️ Extra spacing is a typing artefact, not a different phrase. */ + @Test + fun `surrounding and repeated whitespace does not change the phrase`() { + val phrase = Bip39.phrase(ByteArray(16), words) + assertContentEquals( + Bip39.entropy(phrase, words), + Bip39.entropy(" " + phrase.replace(" ", " ") + "\n", words), + ) + } + + // ---- Base58 ---------------------------------------------------------- + + /** + * πŸ”΄ **The leading-zero rule, which is where money goes missing.** Base58 is + * base conversion of one integer, and an integer cannot hold a leading zero + * byte β€” the standard prepends one `1` per zero byte instead. An + * implementation using `BigInteger` loses them and encodes two different + * keys to one address. + */ + @Test + fun `leading zero bytes each become a one`() { + assertEquals("1", Base58.encode(byteArrayOf(0))) + assertEquals("11", Base58.encode(byteArrayOf(0, 0))) + assertEquals("1111", Base58.encode(byteArrayOf(0, 0, 0, 0))) + // And a zero byte in front of real data is not the same as without it. + assertNotEquals( + Base58.encode(byteArrayOf(1, 2, 3)), + Base58.encode(byteArrayOf(0, 1, 2, 3)), + ) + } + + @Test + fun `base58 round-trips, zeros included`() { + for (case in listOf( + byteArrayOf(), + byteArrayOf(0), + byteArrayOf(0, 0, 0), + byteArrayOf(1), + byteArrayOf(0, 1, 2, 3, 4, 5), + ByteArray(32) { it.toByte() }, + ByteArray(32) { 0xff.toByte() }, + ByteArray(32), + )) { + assertContentEquals(case, Base58.decode(Base58.encode(case)), + "round trip lost ${hex(case)}") + } + } + + @Test + fun `the published Bitcoin vectors encode as stated`() { + assertEquals("2NEpo7TZRRrLZSi2U", Base58.encode("Hello World!".toByteArray())) + assertEquals( + "USm3fpXnKG5EUBx2ndxBDMPVciP5hGey2Jh4NDv6gmeo1LkMeiKrLJUUBk6Z", + Base58.encode("The quick brown fox jumps over the lazy dog.".toByteArray()), + ) + } + + /** + * ⚠️ A mistyped address must FAIL, not resolve to somebody else's. `0`, + * `O`, `I` and `l` are absent from the alphabet for exactly this reason. + */ + @Test + fun `a character outside the alphabet decodes to nothing`() { + assertNull(Base58.decode("0OIl")) + assertNull(Base58.decode("abc def")) + assertNull(Base58.decode("abc+def")) + } + + // ---- SLIP-0010 vectors ----------------------------------------------- + + /** + * SLIP-0010's own ed25519 test vector one. The chain code is checked as + * well as the key: a derivation that gets the key right and the chain code + * wrong produces correct CHILDREN of nothing, and diverges one level down. + */ + @Test + fun `slip10 ed25519 vector one`() { + val seed = unhex("000102030405060708090a0b0c0d0e0f") + val master = HdKey.master(seed) + assertEquals( + "2b4be7f19ee27bbf30c667b642d5f4aa69fd169872f8fc3059c08ebae2eb19e7", + hex(master.privateKey), + ) + assertEquals( + "90046a93de5380a72b5e45010748567d5ea02bbf6522f979e05c0d8d8ca9fffb", + hex(master.chainCode), + ) + + val child = master.derive("m/0H") + assertEquals( + "68e0fe46dfb67e368c75379acec591dad19df3cde26e63b93a8e704f1dade7a3", + hex(child.privateKey), + ) + assertEquals( + "8b59aa11380b624e81507a27fedda59fea6d0b779a778918a2fd3590e16e9c69", + hex(child.chainCode), + ) + + val deeper = master.derive("m/0H/1H/2H/2H/1000000000H") + assertEquals( + "8f94d394a8e8fd6b1bc2f3f49f5c47e385281d5c17e65324b0f62483e37e8793", + hex(deeper.privateKey), + ) + } + + /** SLIP-0010's ed25519 vector two, with a longer seed. */ + @Test + fun `slip10 ed25519 vector two`() { + val seed = unhex( + "fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a2" + + "9f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542" + ) + val master = HdKey.master(seed) + assertEquals( + "171cb88b1b3c1db25add599712e36245d75bc65a1a5c9e18d76f9f2b1eab4012", + hex(master.privateKey), + ) + val child = master.derive("m/0H/2147483647H/1H/2147483646H/2H") + assertEquals( + "551d333177df541ad876a60ea71f00447931c0a9da16f227c11ea080d7391b8d", + hex(child.privateKey), + ) + } + + /** + * πŸ”΄ **A path without hardening is REFUSED, not silently hardened.** + * SLIP-0010 defines no non-hardened derivation for ed25519. Somebody + * writing `m/44` means non-hardened; quietly handing them a different key + * than every other wallet would give them an address nobody else can + * reproduce from the same phrase. + */ + @Test + fun `an unhardened path component is refused`() { + val master = HdKey.master(ByteArray(32) { 1 }) + assertFailsWith { master.derive("m/44") } + assertFailsWith { master.derive("m/44H/501") } + } + + /** ⚠️ All three hardening notations are accepted, since all three are written. */ + @Test + fun `H and h and apostrophe all mean hardened`() { + val master = HdKey.master(ByteArray(32) { 1 }) + assertEquals(master.derive("m/44H"), master.derive("m/44h")) + assertEquals(master.derive("m/44H"), master.derive("m/44'")) + } + + @Test + fun `a malformed path is refused`() { + val master = HdKey.master(ByteArray(32) { 1 }) + assertFailsWith { master.derive("m/notanumberH") } + assertFailsWith { master.derive("m/99999999999H") } + } + + @Test + fun `a seed outside the standard's range is refused`() { + assertFailsWith { HdKey.master(ByteArray(15)) } + assertFailsWith { HdKey.master(ByteArray(65)) } + } + + /** + * ⚠️ Derivation is a pure function of seed and path. Sounds obvious; it is + * the property a restored wallet depends on entirely. + */ + @Test + fun `the same phrase and path always give the same key`() { + val seed = Bip39.seed(Bip39.phrase(ByteArray(16), words)) + assertEquals( + HdKey.master(seed, "m/44H/501H/0H/0H"), + HdKey.master(seed, "m/44H/501H/0H/0H"), + ) + assertNotEquals( + HdKey.master(seed, "m/44H/501H/0H/0H"), + HdKey.master(seed, "m/44H/501H/1H/0H"), + ) + } + + /** + * The BIP-44 shape the wallet actually uses, end to end from a phrase. + * Not a published vector β€” the point is that the whole chain runs and that + * successive accounts differ, which is what "a fresh address per receive" + * rests on. + */ + @Test + fun `a phrase walks the wallet path and gives distinct keys per account`() { + val seed = Bip39.seed(Bip39.phrase(ByteArray(32), words)) + val keys = (0..4).map { HdKey.master(seed, "m/44H/501H/${it}H/0H").privateKey } + assertEquals(5, keys.map { hex(it) }.toSet().size, "two accounts derived the same key") + assertTrue(keys.all { it.size == 32 }) + } +}