<commit_before>/* global describe, it */

var assert = require('assert')
var async = require('async')
var bigi = require('bigi')
var bitcoin = require('../../')
var blockchain = require('./_blockchain')
var crypto = require('crypto')

var ecurve = require('ecurve')
var secp256k1 = ecurve.getCurveByName('secp256k1')

describe('bitcoinjs-lib (crypto)', function () {
  it('can generate a single-key stealth address', function () {
    var G = secp256k1.G
    var n = secp256k1.n

    function stealthSend (Q) {
      var noncePair = bitcoin.ECPair.makeRandom()
      var e = noncePair.d
      var eQ = Q.multiply(e) // shared secret
      var c = bigi.fromBuffer(bitcoin.crypto.sha256(eQ.getEncoded()))
      var cG = G.multiply(c)
      var Qprime = Q.add(cG)

      return {
        shared: new bitcoin.ECPair(null, Qprime),
        nonce: new bitcoin.ECPair(null, noncePair.Q)
      }
    }

    function stealthReceive (d, P) {
      var dP = P.multiply(d) // shared secret
      var c = bigi.fromBuffer(bitcoin.crypto.sha256(dP.getEncoded()))
      var derived = new bitcoin.ECPair(d.add(c).mod(n))

      return derived
    }

    // receiver private key
    var receiver = bitcoin.ECPair.fromWIF('<KEY>')

    var stealthS = stealthSend(receiver.Q) // public, done by sender
    // ... sender now reveals nonce to receiver

    var stealthR = stealthReceive(receiver.d, stealthS.nonce.Q) // private, done by receiver

    // and check that we derived both sides correctly
    assert.equal(stealthS.shared.getAddress(), stealthR.getAddress())
  })

  // TODO
  it.skip('can generate a dual-key stealth address', function () {})

  it("can recover a parent private key from the parent's public key and a derived non-hardened child private key", function () {
    function recoverParent (master, child) {
      assert(!master.keyPair.d, 'You already have the parent private key')
      assert(child.keyPair.d, 'Missing child private key')

      var curve = secp256k1
      var QP = master.keyPair.Q
      var serQP = master.keyPair.getPublicKeyBuffer()

      var d1 = child.keyPair.d
      var d2
      var data = new Buffer(37)
      serQP.copy(data, 0)

      // search index space until we find it
      for (var i = 0; i < bitcoin.HDNode.HIGHEST_BIT; ++i) {
        data.writeUInt32BE(i, 33)

        // calculate I
        var I = crypto.createHmac('sha512', master.chainCode).update(data).digest()
        var IL = I.slice(0, 32)
        var pIL = bigi.fromBuffer(IL)

        // See hdnode.js:273 to understand
        d2 = d1.subtract(pIL).mod(curve.n)

        var Qp = new bitcoin.ECPair(d2).Q
        if (Qp.equals(QP)) break
      }
<commit_msg>integration: fix HDNode search space<commit_after>/* global describe, it */

var assert = require('assert')
var async = require('async')
var bigi = require('bigi')
var bitcoin = require('../../')
var blockchain = require('./_blockchain')
var crypto = require('crypto')

var ecurve = require('ecurve')
var secp256k1 = ecurve.getCurveByName('secp256k1')

describe('bitcoinjs-lib (crypto)', function () {
  it('can generate a single-key stealth address', function () {
    var G = secp256k1.G
    var n = secp256k1.n

    function stealthSend (Q) {
      var noncePair = bitcoin.ECPair.makeRandom()
      var e = noncePair.d
      var eQ = Q.multiply(e) // shared secret
      var c = bigi.fromBuffer(bitcoin.crypto.sha256(eQ.getEncoded()))
      var cG = G.multiply(c)
      var Qprime = Q.add(cG)

      return {
        shared: new bitcoin.ECPair(null, Qprime),
        nonce: new bitcoin.ECPair(null, noncePair.Q)
      }
    }

    function stealthReceive (d, P) {
      var dP = P.multiply(d) // shared secret
      var c = bigi.fromBuffer(bitcoin.crypto.sha256(dP.getEncoded()))
      var derived = new bitcoin.ECPair(d.add(c).mod(n))

      return derived
    }

    // receiver private key
    var receiver = bitcoin.ECPair.fromWIF('<KEY>')

    var stealthS = stealthSend(receiver.Q) // public, done by sender
    // ... sender now reveals nonce to receiver

    var stealthR = stealthReceive(receiver.d, stealthS.nonce.Q) // private, done by receiver

    // and check that we derived both sides correctly
    assert.equal(stealthS.shared.getAddress(), stealthR.getAddress())
  })

  // TODO
  it.skip('can generate a dual-key stealth address', function () {})

  it("can recover a parent private key from the parent's public key and a derived non-hardened child private key", function () {
    function recoverParent (master, child) {
      assert(!master.keyPair.d, 'You already have the parent private key')
      assert(child.keyPair.d, 'Missing child private key')

      var curve = secp256k1
      var QP = master.keyPair.Q
      var serQP = master.keyPair.getPublicKeyBuffer()

      var d1 = child.keyPair.d
      var d2
      var data = new Buffer(37)
      serQP.copy(data, 0)

      // search index space until we find it
      for (var i = 0; i < 0x80000000; ++i) {
        data.writeUInt32BE(i, 33)

        // calculate I
        var I = crypto.createHmac('sha512', master.chainCode).update(data).digest()
        var IL = I.slice(0, 32)
        var pIL = bigi.fromBuffer(IL)

        // See hdnode.js:273 to understand
        d2 = d1.subtract(pIL).mod(curve.n)

        var Qp = new bitcoin.ECPair(d2).Q
        if (Qp.equals(QP)) break
      }

{'fraction_non_alphanumeric': 0.12507031689480594, 'fraction_numerical': 0.019688730545659103, 'mean_word_length': 2.6964656964656966, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 1, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1751655', 'n_tokens_mistral': 1857, 'n_tokens_neox': 1699, 'n_words': 478}