ghost43
5 years ago
committed by
GitHub
13 changed files with 2296 additions and 61 deletions
@ -0,0 +1,612 @@
|
||||
# Copyright (c) 2018 Andrew R. Kozlik |
||||
# |
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy of |
||||
# this software and associated documentation files (the "Software"), to deal in |
||||
# the Software without restriction, including without limitation the rights to |
||||
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies |
||||
# of the Software, and to permit persons to whom the Software is furnished to do |
||||
# so, subject to the following conditions: |
||||
# |
||||
# The above copyright notice and this permission notice shall be included in all |
||||
# copies or substantial portions of the Software. |
||||
# |
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||||
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
||||
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, |
||||
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN |
||||
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. |
||||
# |
||||
|
||||
""" |
||||
This implements the high-level functions for SLIP-39, also called "Shamir Backup". |
||||
|
||||
See https://github.com/satoshilabs/slips/blob/master/slip-0039.md. |
||||
""" |
||||
|
||||
import hmac |
||||
from collections import defaultdict |
||||
from hashlib import pbkdf2_hmac |
||||
from typing import Dict, Iterable, List, Optional, Set, Tuple |
||||
|
||||
from .i18n import _ |
||||
from .mnemonic import Wordlist |
||||
|
||||
Indices = Tuple[int, ...] |
||||
MnemonicGroups = Dict[int, Tuple[int, Set[Tuple[int, bytes]]]] |
||||
|
||||
|
||||
""" |
||||
## Simple helpers |
||||
""" |
||||
|
||||
_RADIX_BITS = 10 |
||||
"""The length of the radix in bits.""" |
||||
|
||||
|
||||
def _bits_to_bytes(n: int) -> int: |
||||
return (n + 7) // 8 |
||||
|
||||
|
||||
def _bits_to_words(n: int) -> int: |
||||
return (n + _RADIX_BITS - 1) // _RADIX_BITS |
||||
|
||||
|
||||
def _xor(a: bytes, b: bytes) -> bytes: |
||||
return bytes(x ^ y for x, y in zip(a, b)) |
||||
|
||||
|
||||
""" |
||||
## Constants |
||||
""" |
||||
|
||||
_ID_LENGTH_BITS = 15 |
||||
"""The length of the random identifier in bits.""" |
||||
|
||||
_ITERATION_EXP_LENGTH_BITS = 5 |
||||
"""The length of the iteration exponent in bits.""" |
||||
|
||||
_ID_EXP_LENGTH_WORDS = _bits_to_words(_ID_LENGTH_BITS + _ITERATION_EXP_LENGTH_BITS) |
||||
"""The length of the random identifier and iteration exponent in words.""" |
||||
|
||||
_CHECKSUM_LENGTH_WORDS = 3 |
||||
"""The length of the RS1024 checksum in words.""" |
||||
|
||||
_DIGEST_LENGTH_BYTES = 4 |
||||
"""The length of the digest of the shared secret in bytes.""" |
||||
|
||||
_CUSTOMIZATION_STRING = b"shamir" |
||||
"""The customization string used in the RS1024 checksum and in the PBKDF2 salt.""" |
||||
|
||||
_GROUP_PREFIX_LENGTH_WORDS = _ID_EXP_LENGTH_WORDS + 1 |
||||
"""The length of the prefix of the mnemonic that is common to a share group.""" |
||||
|
||||
_METADATA_LENGTH_WORDS = _ID_EXP_LENGTH_WORDS + 2 + _CHECKSUM_LENGTH_WORDS |
||||
"""The length of the mnemonic in words without the share value.""" |
||||
|
||||
_MIN_STRENGTH_BITS = 128 |
||||
"""The minimum allowed entropy of the master secret.""" |
||||
|
||||
_MIN_MNEMONIC_LENGTH_WORDS = _METADATA_LENGTH_WORDS + _bits_to_words(_MIN_STRENGTH_BITS) |
||||
"""The minimum allowed length of the mnemonic in words.""" |
||||
|
||||
_BASE_ITERATION_COUNT = 10000 |
||||
"""The minimum number of iterations to use in PBKDF2.""" |
||||
|
||||
_ROUND_COUNT = 4 |
||||
"""The number of rounds to use in the Feistel cipher.""" |
||||
|
||||
_SECRET_INDEX = 255 |
||||
"""The index of the share containing the shared secret.""" |
||||
|
||||
_DIGEST_INDEX = 254 |
||||
"""The index of the share containing the digest of the shared secret.""" |
||||
|
||||
|
||||
""" |
||||
# External API |
||||
""" |
||||
|
||||
|
||||
class Slip39Error(RuntimeError): |
||||
pass |
||||
|
||||
|
||||
class Share: |
||||
""" |
||||
Represents a single mnemonic and offers its parsed metadata. |
||||
""" |
||||
|
||||
def __init__( |
||||
self, |
||||
identifier: int, |
||||
iteration_exponent: int, |
||||
group_index: int, |
||||
group_threshold: int, |
||||
group_count: int, |
||||
member_index: int, |
||||
member_threshold: int, |
||||
share_value: bytes, |
||||
): |
||||
self.index = None |
||||
self.identifier = identifier |
||||
self.iteration_exponent = iteration_exponent |
||||
self.group_index = group_index |
||||
self.group_threshold = group_threshold |
||||
self.group_count = group_count |
||||
self.member_index = member_index |
||||
self.member_threshold = member_threshold |
||||
self.share_value = share_value |
||||
|
||||
def common_parameters(self) -> tuple: |
||||
"""Return the values that uniquely identify a matching set of shares.""" |
||||
return ( |
||||
self.identifier, |
||||
self.iteration_exponent, |
||||
self.group_threshold, |
||||
self.group_count, |
||||
) |
||||
|
||||
|
||||
class EncryptedSeed: |
||||
""" |
||||
Represents the encrypted master seed for BIP-32. |
||||
""" |
||||
|
||||
def __init__(self, identifier: int, iteration_exponent: int, encrypted_master_secret: bytes): |
||||
self.identifier = identifier |
||||
self.iteration_exponent = iteration_exponent |
||||
self.encrypted_master_secret = encrypted_master_secret |
||||
|
||||
def decrypt(self, passphrase: str) -> bytes: |
||||
""" |
||||
Converts the Encrypted Master Secret to a Master Secret by applying the passphrase. |
||||
This is analogous to BIP-39 passphrase derivation. We do not use the term "derive" |
||||
here, because passphrase function is symmetric in SLIP-39. We are using the terms |
||||
"encrypt" and "decrypt" instead. |
||||
""" |
||||
passphrase = (passphrase or '').encode('utf-8') |
||||
ems_len = len(self.encrypted_master_secret) |
||||
l = self.encrypted_master_secret[: ems_len // 2] |
||||
r = self.encrypted_master_secret[ems_len // 2 :] |
||||
salt = _get_salt(self.identifier) |
||||
for i in reversed(range(_ROUND_COUNT)): |
||||
(l, r) = ( |
||||
r, |
||||
_xor(l, _round_function(i, passphrase, self.iteration_exponent, salt, r)), |
||||
) |
||||
return r + l |
||||
|
||||
|
||||
def recover_ems(mnemonics: List[str]) -> EncryptedSeed: |
||||
""" |
||||
Combines mnemonic shares to obtain the encrypted master secret which was previously |
||||
split using Shamir's secret sharing scheme. |
||||
Returns identifier, iteration exponent and the encrypted master secret. |
||||
""" |
||||
|
||||
if not mnemonics: |
||||
raise Slip39Error("The list of mnemonics is empty.") |
||||
|
||||
( |
||||
identifier, |
||||
iteration_exponent, |
||||
group_threshold, |
||||
group_count, |
||||
groups, |
||||
) = _decode_mnemonics(mnemonics) |
||||
|
||||
# Use only groups that have at least the threshold number of shares. |
||||
groups = {group_index: group for group_index, group in groups.items() if len(group[1]) >= group[0]} |
||||
|
||||
if len(groups) < group_threshold: |
||||
raise Slip39Error( |
||||
"Insufficient number of mnemonic groups. Expected {} full groups, but {} were provided.".format( |
||||
group_threshold, len(groups) |
||||
) |
||||
) |
||||
|
||||
group_shares = [ |
||||
(group_index, _recover_secret(group[0], list(group[1]))) |
||||
for group_index, group in groups.items() |
||||
] |
||||
|
||||
encrypted_master_secret = _recover_secret(group_threshold, group_shares) |
||||
return EncryptedSeed(identifier, iteration_exponent, encrypted_master_secret) |
||||
|
||||
|
||||
def decode_mnemonic(mnemonic: str) -> Share: |
||||
"""Converts a share mnemonic to share data.""" |
||||
|
||||
mnemonic_data = tuple(_mnemonic_to_indices(mnemonic)) |
||||
|
||||
if len(mnemonic_data) < _MIN_MNEMONIC_LENGTH_WORDS: |
||||
raise Slip39Error(_('Too short.')) |
||||
|
||||
padding_len = (_RADIX_BITS * (len(mnemonic_data) - _METADATA_LENGTH_WORDS)) % 16 |
||||
if padding_len > 8: |
||||
raise Slip39Error(_('Invalid length.')) |
||||
|
||||
if not _rs1024_verify_checksum(mnemonic_data): |
||||
raise Slip39Error(_('Invalid mnemonic checksum.')) |
||||
|
||||
id_exp_int = _int_from_indices(mnemonic_data[:_ID_EXP_LENGTH_WORDS]) |
||||
identifier = id_exp_int >> _ITERATION_EXP_LENGTH_BITS |
||||
iteration_exponent = id_exp_int & ((1 << _ITERATION_EXP_LENGTH_BITS) - 1) |
||||
tmp = _int_from_indices( |
||||
mnemonic_data[_ID_EXP_LENGTH_WORDS : _ID_EXP_LENGTH_WORDS + 2] |
||||
) |
||||
( |
||||
group_index, |
||||
group_threshold, |
||||
group_count, |
||||
member_index, |
||||
member_threshold, |
||||
) = _int_to_indices(tmp, 5, 4) |
||||
value_data = mnemonic_data[_ID_EXP_LENGTH_WORDS + 2 : -_CHECKSUM_LENGTH_WORDS] |
||||
|
||||
if group_count < group_threshold: |
||||
raise Slip39Error(_('Invalid mnemonic group threshold.')) |
||||
|
||||
value_byte_count = _bits_to_bytes(_RADIX_BITS * len(value_data) - padding_len) |
||||
value_int = _int_from_indices(value_data) |
||||
if value_data[0] >= 1 << (_RADIX_BITS - padding_len): |
||||
raise Slip39Error(_('Invalid mnemonic padding.')) |
||||
value = value_int.to_bytes(value_byte_count, "big") |
||||
|
||||
return Share( |
||||
identifier, |
||||
iteration_exponent, |
||||
group_index, |
||||
group_threshold + 1, |
||||
group_count + 1, |
||||
member_index, |
||||
member_threshold + 1, |
||||
value, |
||||
) |
||||
|
||||
|
||||
def get_wordlist() -> Wordlist: |
||||
wordlist = Wordlist.from_file('slip39.txt') |
||||
|
||||
required_words = 2**_RADIX_BITS |
||||
if len(wordlist) != required_words: |
||||
raise Slip39Error( |
||||
f"The wordlist should contain {required_words} words, but it contains {len(wordlist)} words." |
||||
) |
||||
|
||||
return wordlist |
||||
|
||||
|
||||
def process_mnemonics(mnemonics: List[str]) -> Tuple[bool, str]: |
||||
# Collect valid shares. |
||||
shares = [] |
||||
for i, mnemonic in enumerate(mnemonics): |
||||
try: |
||||
share = decode_mnemonic(mnemonic) |
||||
share.index = i + 1 |
||||
shares.append(share) |
||||
except Slip39Error: |
||||
pass |
||||
|
||||
if not shares: |
||||
return None, _('No valid shares.') |
||||
|
||||
# Sort shares into groups. |
||||
groups: Dict[int, Set[Share]] = defaultdict(set) # group idx : shares |
||||
common_params = shares[0].common_parameters() |
||||
for share in shares: |
||||
if share.common_parameters() != common_params: |
||||
error_text = _("Share") + ' #%d ' % share.index + _("is not part of the current set.") |
||||
return None, _ERROR_STYLE % error_text |
||||
for other in groups[share.group_index]: |
||||
if share.member_index == other.member_index: |
||||
error_text = _("Share") + ' #%d ' % share.index + _("is a duplicate of share") + ' #%d.' % other.index |
||||
return None, _ERROR_STYLE % error_text |
||||
groups[share.group_index].add(share) |
||||
|
||||
# Compile information about groups. |
||||
groups_completed = 0 |
||||
for i, group in groups.items(): |
||||
if group: |
||||
member_threshold = next(iter(group)).member_threshold |
||||
if len(group) >= member_threshold: |
||||
groups_completed += 1 |
||||
|
||||
identifier = shares[0].identifier |
||||
iteration_exponent = shares[0].iteration_exponent |
||||
group_threshold = shares[0].group_threshold |
||||
group_count = shares[0].group_count |
||||
status = '' |
||||
if group_count > 1: |
||||
status += _('Completed') + ' <b>%d</b> ' % groups_completed + _('of') + ' <b>%d</b> ' % group_threshold + _('groups needed:<br/>') |
||||
|
||||
for group_index in range(group_count): |
||||
group_prefix = _make_group_prefix(identifier, iteration_exponent, group_index, group_threshold, group_count) |
||||
status += _group_status(groups[group_index], group_prefix) |
||||
|
||||
if groups_completed >= group_threshold: |
||||
if len(mnemonics) > len(shares): |
||||
status += _ERROR_STYLE % _('Some shares are invalid.') |
||||
else: |
||||
try: |
||||
encrypted_seed = recover_ems(mnemonics) |
||||
status += '<b>' + _('The set is complete!') + '</b>' |
||||
except Slip39Error as e: |
||||
encrypted_seed = None |
||||
status = _ERROR_STYLE % str(e) |
||||
return encrypted_seed, status |
||||
|
||||
return None, status |
||||
|
||||
|
||||
""" |
||||
## Group status helpers |
||||
""" |
||||
|
||||
_FINISHED = '<span style="color:green;">✔</span>' |
||||
_EMPTY = '<span style="color:red;">✕</span>' |
||||
_INPROGRESS = '<span style="color:orange;">⚫</span>' |
||||
_ERROR_STYLE = '<span style="color:red; font-weight:bold;">' + _('Error') + ': %s</span>' |
||||
|
||||
def _make_group_prefix(identifier, iteration_exponent, group_index, group_threshold, group_count): |
||||
wordlist = get_wordlist() |
||||
val = identifier |
||||
val <<= _ITERATION_EXP_LENGTH_BITS |
||||
val += iteration_exponent |
||||
val <<= 4 |
||||
val += group_index |
||||
val <<= 4 |
||||
val += group_threshold - 1 |
||||
val <<= 4 |
||||
val += group_count - 1 |
||||
val >>= 2 |
||||
prefix = ' '.join(wordlist[idx] for idx in _int_to_indices(val, _GROUP_PREFIX_LENGTH_WORDS, _RADIX_BITS)) |
||||
return prefix |
||||
|
||||
|
||||
def _group_status(group: Set[Share], group_prefix) -> str: |
||||
len(group) |
||||
if not group: |
||||
return _EMPTY + '<b>0</b> ' + _('shares from group') + ' <b>' + group_prefix + '</b>.<br/>' |
||||
else: |
||||
share = next(iter(group)) |
||||
icon = _FINISHED if len(group) >= share.member_threshold else _INPROGRESS |
||||
return icon + '<b>%d</b> ' % len(group) + _('of') + ' <b>%d</b> ' % share.member_threshold + _('shares needed from group') + ' <b>%s</b>.<br/>' % group_prefix |
||||
|
||||
|
||||
""" |
||||
## Convert mnemonics or integers to indices and back |
||||
""" |
||||
|
||||
|
||||
def _int_from_indices(indices: Indices) -> int: |
||||
"""Converts a list of base 1024 indices in big endian order to an integer value.""" |
||||
value = 0 |
||||
for index in indices: |
||||
value = (value << _RADIX_BITS) + index |
||||
return value |
||||
|
||||
|
||||
def _int_to_indices(value: int, output_length: int, bits: int) -> Iterable[int]: |
||||
"""Converts an integer value to indices in big endian order.""" |
||||
mask = (1 << bits) - 1 |
||||
return ((value >> (i * bits)) & mask for i in reversed(range(output_length))) |
||||
|
||||
|
||||
def _mnemonic_to_indices(mnemonic: str) -> List[int]: |
||||
wordlist = get_wordlist() |
||||
indices = [] |
||||
for word in mnemonic.split(): |
||||
try: |
||||
indices.append(wordlist.index(word.lower())) |
||||
except ValueError: |
||||
if len(word) > 8: |
||||
word = word[:8] + '...' |
||||
raise Slip39Error(_('Invalid mnemonic word') + ' "%s".' % word) from None |
||||
return indices |
||||
|
||||
|
||||
""" |
||||
## Checksum functions |
||||
""" |
||||
|
||||
|
||||
def _rs1024_polymod(values: Indices) -> int: |
||||
GEN = ( |
||||
0xE0E040, |
||||
0x1C1C080, |
||||
0x3838100, |
||||
0x7070200, |
||||
0xE0E0009, |
||||
0x1C0C2412, |
||||
0x38086C24, |
||||
0x3090FC48, |
||||
0x21B1F890, |
||||
0x3F3F120, |
||||
) |
||||
chk = 1 |
||||
for v in values: |
||||
b = chk >> 20 |
||||
chk = (chk & 0xFFFFF) << 10 ^ v |
||||
for i in range(10): |
||||
chk ^= GEN[i] if ((b >> i) & 1) else 0 |
||||
return chk |
||||
|
||||
|
||||
def _rs1024_verify_checksum(data: Indices) -> bool: |
||||
""" |
||||
Verifies a checksum of the given mnemonic, which was already parsed into Indices. |
||||
""" |
||||
return _rs1024_polymod(tuple(_CUSTOMIZATION_STRING) + data) == 1 |
||||
|
||||
|
||||
""" |
||||
## Internal functions |
||||
""" |
||||
|
||||
|
||||
def _precompute_exp_log() -> Tuple[List[int], List[int]]: |
||||
exp = [0 for i in range(255)] |
||||
log = [0 for i in range(256)] |
||||
|
||||
poly = 1 |
||||
for i in range(255): |
||||
exp[i] = poly |
||||
log[poly] = i |
||||
|
||||
# Multiply poly by the polynomial x + 1. |
||||
poly = (poly << 1) ^ poly |
||||
|
||||
# Reduce poly by x^8 + x^4 + x^3 + x + 1. |
||||
if poly & 0x100: |
||||
poly ^= 0x11B |
||||
|
||||
return exp, log |
||||
|
||||
|
||||
_EXP_TABLE, _LOG_TABLE = _precompute_exp_log() |
||||
|
||||
|
||||
def _interpolate(shares, x) -> bytes: |
||||
""" |
||||
Returns f(x) given the Shamir shares (x_1, f(x_1)), ... , (x_k, f(x_k)). |
||||
:param shares: The Shamir shares. |
||||
:type shares: A list of pairs (x_i, y_i), where x_i is an integer and y_i is an array of |
||||
bytes representing the evaluations of the polynomials in x_i. |
||||
:param int x: The x coordinate of the result. |
||||
:return: Evaluations of the polynomials in x. |
||||
:rtype: Array of bytes. |
||||
""" |
||||
|
||||
x_coordinates = set(share[0] for share in shares) |
||||
|
||||
if len(x_coordinates) != len(shares): |
||||
raise Slip39Error("Invalid set of shares. Share indices must be unique.") |
||||
|
||||
share_value_lengths = set(len(share[1]) for share in shares) |
||||
if len(share_value_lengths) != 1: |
||||
raise Slip39Error( |
||||
"Invalid set of shares. All share values must have the same length." |
||||
) |
||||
|
||||
if x in x_coordinates: |
||||
for share in shares: |
||||
if share[0] == x: |
||||
return share[1] |
||||
|
||||
# Logarithm of the product of (x_i - x) for i = 1, ... , k. |
||||
log_prod = sum(_LOG_TABLE[share[0] ^ x] for share in shares) |
||||
|
||||
result = bytes(share_value_lengths.pop()) |
||||
for share in shares: |
||||
# The logarithm of the Lagrange basis polynomial evaluated at x. |
||||
log_basis_eval = ( |
||||
log_prod |
||||
- _LOG_TABLE[share[0] ^ x] |
||||
- sum(_LOG_TABLE[share[0] ^ other[0]] for other in shares) |
||||
) % 255 |
||||
|
||||
result = bytes( |
||||
intermediate_sum |
||||
^ ( |
||||
_EXP_TABLE[(_LOG_TABLE[share_val] + log_basis_eval) % 255] |
||||
if share_val != 0 |
||||
else 0 |
||||
) |
||||
for share_val, intermediate_sum in zip(share[1], result) |
||||
) |
||||
|
||||
return result |
||||
|
||||
|
||||
def _round_function(i: int, passphrase: bytes, e: int, salt: bytes, r: bytes) -> bytes: |
||||
"""The round function used internally by the Feistel cipher.""" |
||||
return pbkdf2_hmac( |
||||
"sha256", |
||||
bytes([i]) + passphrase, |
||||
salt + r, |
||||
(_BASE_ITERATION_COUNT << e) // _ROUND_COUNT, |
||||
dklen=len(r), |
||||
) |
||||
|
||||
|
||||
def _get_salt(identifier: int) -> bytes: |
||||
return _CUSTOMIZATION_STRING + identifier.to_bytes( |
||||
_bits_to_bytes(_ID_LENGTH_BITS), "big" |
||||
) |
||||
|
||||
|
||||
def _create_digest(random_data: bytes, shared_secret: bytes) -> bytes: |
||||
return hmac.new(random_data, shared_secret, "sha256").digest()[:_DIGEST_LENGTH_BYTES] |
||||
|
||||
|
||||
def _recover_secret(threshold: int, shares: List[Tuple[int, bytes]]) -> bytes: |
||||
# If the threshold is 1, then the digest of the shared secret is not used. |
||||
if threshold == 1: |
||||
return shares[0][1] |
||||
|
||||
shared_secret = _interpolate(shares, _SECRET_INDEX) |
||||
digest_share = _interpolate(shares, _DIGEST_INDEX) |
||||
digest = digest_share[:_DIGEST_LENGTH_BYTES] |
||||
random_part = digest_share[_DIGEST_LENGTH_BYTES:] |
||||
|
||||
if digest != _create_digest(random_part, shared_secret): |
||||
raise Slip39Error("Invalid digest of the shared secret.") |
||||
|
||||
return shared_secret |
||||
|
||||
|
||||
def _decode_mnemonics( |
||||
mnemonics: List[str], |
||||
) -> Tuple[int, int, int, int, MnemonicGroups]: |
||||
identifiers = set() |
||||
iteration_exponents = set() |
||||
group_thresholds = set() |
||||
group_counts = set() |
||||
|
||||
# { group_index : [threshold, set_of_member_shares] } |
||||
groups = {} # type: MnemonicGroups |
||||
for mnemonic in mnemonics: |
||||
share = decode_mnemonic(mnemonic) |
||||
identifiers.add(share.identifier) |
||||
iteration_exponents.add(share.iteration_exponent) |
||||
group_thresholds.add(share.group_threshold) |
||||
group_counts.add(share.group_count) |
||||
group = groups.setdefault(share.group_index, (share.member_threshold, set())) |
||||
if group[0] != share.member_threshold: |
||||
raise Slip39Error( |
||||
"Invalid set of mnemonics. All mnemonics in a group must have the same member threshold." |
||||
) |
||||
group[1].add((share.member_index, share.share_value)) |
||||
|
||||
if len(identifiers) != 1 or len(iteration_exponents) != 1: |
||||
raise Slip39Error( |
||||
"Invalid set of mnemonics. All mnemonics must begin with the same {} words.".format( |
||||
_ID_EXP_LENGTH_WORDS |
||||
) |
||||
) |
||||
|
||||
if len(group_thresholds) != 1: |
||||
raise Slip39Error( |
||||
"Invalid set of mnemonics. All mnemonics must have the same group threshold." |
||||
) |
||||
|
||||
if len(group_counts) != 1: |
||||
raise Slip39Error( |
||||
"Invalid set of mnemonics. All mnemonics must have the same group count." |
||||
) |
||||
|
||||
for group_index, group in groups.items(): |
||||
if len(set(share[0] for share in group[1])) != len(group[1]): |
||||
raise Slip39Error( |
||||
"Invalid set of shares. Member indices in each group must be unique." |
||||
) |
||||
|
||||
return ( |
||||
identifiers.pop(), |
||||
iteration_exponents.pop(), |
||||
group_thresholds.pop(), |
||||
group_counts.pop(), |
||||
groups, |
||||
) |
||||
@ -0,0 +1,331 @@
|
||||
[ |
||||
[ |
||||
"1. Valid mnemonic without sharing (128 bits)", |
||||
[ |
||||
"duckling enlarge academic academic agency result length solution fridge kidney coal piece deal husband erode duke ajar critical decision keyboard" |
||||
], |
||||
"bb54aac4b89dc868ba37d9cc21b2cece" |
||||
], |
||||
[ |
||||
"2. Mnemonic with invalid checksum (128 bits)", |
||||
[ |
||||
"duckling enlarge academic academic agency result length solution fridge kidney coal piece deal husband erode duke ajar critical decision kidney" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"3. Mnemonic with invalid padding (128 bits)", |
||||
[ |
||||
"duckling enlarge academic academic email result length solution fridge kidney coal piece deal husband erode duke ajar music cargo fitness" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"4. Basic sharing 2-of-3 (128 bits)", |
||||
[ |
||||
"shadow pistol academic always adequate wildlife fancy gross oasis cylinder mustang wrist rescue view short owner flip making coding armed", |
||||
"shadow pistol academic acid actress prayer class unknown daughter sweater depict flip twice unkind craft early superior advocate guest smoking" |
||||
], |
||||
"b43ceb7e57a0ea8766221624d01b0864" |
||||
], |
||||
[ |
||||
"5. Basic sharing 2-of-3 (128 bits)", |
||||
[ |
||||
"shadow pistol academic always adequate wildlife fancy gross oasis cylinder mustang wrist rescue view short owner flip making coding armed" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"6. Mnemonics with different identifiers (128 bits)", |
||||
[ |
||||
"adequate smoking academic acid debut wine petition glen cluster slow rhyme slow simple epidemic rumor junk tracks treat olympic tolerate", |
||||
"adequate stay academic agency agency formal party ting frequent learn upstairs remember smear leaf damage anatomy ladle market hush corner" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"7. Mnemonics with different iteration exponents (128 bits)", |
||||
[ |
||||
"peasant leaves academic acid desert exact olympic math alive axle trial tackle drug deny decent smear dominant desert bucket remind", |
||||
"peasant leader academic agency cultural blessing percent network envelope medal junk primary human pumps jacket fragment payroll ticket evoke voice" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"8. Mnemonics with mismatching group thresholds (128 bits)", |
||||
[ |
||||
"liberty category beard echo animal fawn temple briefing math username various wolf aviation fancy visual holy thunder yelp helpful payment", |
||||
"liberty category beard email beyond should fancy romp founder easel pink holy hairy romp loyalty material victim owner toxic custody", |
||||
"liberty category academic easy being hazard crush diminish oral lizard reaction cluster force dilemma deploy force club veteran expect photo" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"9. Mnemonics with mismatching group counts (128 bits)", |
||||
[ |
||||
"average senior academic leaf broken teacher expect surface hour capture obesity desire negative dynamic dominant pistol mineral mailman iris aide", |
||||
"average senior academic agency curious pants blimp spew clothes slice script dress wrap firm shaft regular slavery negative theater roster" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"10. Mnemonics with greater group threshold than group counts (128 bits)", |
||||
[ |
||||
"music husband acrobat acid artist finance center either graduate swimming object bike medical clothes station aspect spider maiden bulb welcome", |
||||
"music husband acrobat agency advance hunting bike corner density careful material civil evil tactics remind hawk discuss hobo voice rainbow", |
||||
"music husband beard academic black tricycle clock mayor estimate level photo episode exclude ecology papa source amazing salt verify divorce" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"11. Mnemonics with duplicate member indices (128 bits)", |
||||
[ |
||||
"device stay academic always dive coal antenna adult black exceed stadium herald advance soldier busy dryer daughter evaluate minister laser", |
||||
"device stay academic always dwarf afraid robin gravity crunch adjust soul branch walnut coastal dream costume scholar mortgage mountain pumps" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"12. Mnemonics with mismatching member thresholds (128 bits)", |
||||
[ |
||||
"hour painting academic academic device formal evoke guitar random modern justice filter withdraw trouble identify mailman insect general cover oven", |
||||
"hour painting academic agency artist again daisy capital beaver fiber much enjoy suitable symbolic identify photo editor romp float echo" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"13. Mnemonics giving an invalid digest (128 bits)", |
||||
[ |
||||
"guilt walnut academic acid deliver remove equip listen vampire tactics nylon rhythm failure husband fatigue alive blind enemy teaspoon rebound", |
||||
"guilt walnut academic agency brave hamster hobo declare herd taste alpha slim criminal mild arcade formal romp branch pink ambition" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"14. Insufficient number of groups (128 bits, case 1)", |
||||
[ |
||||
"eraser senior beard romp adorn nuclear spill corner cradle style ancient family general leader ambition exchange unusual garlic promise voice" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"15. Insufficient number of groups (128 bits, case 2)", |
||||
[ |
||||
"eraser senior decision scared cargo theory device idea deliver modify curly include pancake both news skin realize vitamins away join", |
||||
"eraser senior decision roster beard treat identify grumpy salt index fake aviation theater cubic bike cause research dragon emphasis counter" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"16. Threshold number of groups, but insufficient number of members in one group (128 bits)", |
||||
[ |
||||
"eraser senior decision shadow artist work morning estate greatest pipeline plan ting petition forget hormone flexible general goat admit surface", |
||||
"eraser senior beard romp adorn nuclear spill corner cradle style ancient family general leader ambition exchange unusual garlic promise voice" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"17. Threshold number of groups and members in each group (128 bits, case 1)", |
||||
[ |
||||
"eraser senior decision roster beard treat identify grumpy salt index fake aviation theater cubic bike cause research dragon emphasis counter", |
||||
"eraser senior ceramic snake clay various huge numb argue hesitate auction category timber browser greatest hanger petition script leaf pickup", |
||||
"eraser senior ceramic shaft dynamic become junior wrist silver peasant force math alto coal amazing segment yelp velvet image paces", |
||||
"eraser senior ceramic round column hawk trust auction smug shame alive greatest sheriff living perfect corner chest sled fumes adequate", |
||||
"eraser senior decision smug corner ruin rescue cubic angel tackle skin skunk program roster trash rumor slush angel flea amazing" |
||||
], |
||||
"7c3397a292a5941682d7a4ae2d898d11" |
||||
], |
||||
[ |
||||
"18. Threshold number of groups and members in each group (128 bits, case 2)", |
||||
[ |
||||
"eraser senior decision smug corner ruin rescue cubic angel tackle skin skunk program roster trash rumor slush angel flea amazing", |
||||
"eraser senior beard romp adorn nuclear spill corner cradle style ancient family general leader ambition exchange unusual garlic promise voice", |
||||
"eraser senior decision scared cargo theory device idea deliver modify curly include pancake both news skin realize vitamins away join" |
||||
], |
||||
"7c3397a292a5941682d7a4ae2d898d11" |
||||
], |
||||
[ |
||||
"19. Threshold number of groups and members in each group (128 bits, case 3)", |
||||
[ |
||||
"eraser senior beard romp adorn nuclear spill corner cradle style ancient family general leader ambition exchange unusual garlic promise voice", |
||||
"eraser senior acrobat romp bishop medical gesture pumps secret alive ultimate quarter priest subject class dictate spew material endless market" |
||||
], |
||||
"7c3397a292a5941682d7a4ae2d898d11" |
||||
], |
||||
[ |
||||
"20. Valid mnemonic without sharing (256 bits)", |
||||
[ |
||||
"theory painting academic academic armed sweater year military elder discuss acne wildlife boring employer fused large satoshi bundle carbon diagnose anatomy hamster leaves tracks paces beyond phantom capital marvel lips brave detect luck" |
||||
], |
||||
"989baf9dcaad5b10ca33dfd8cc75e42477025dce88ae83e75a230086a0e00e92" |
||||
], |
||||
[ |
||||
"21. Mnemonic with invalid checksum (256 bits)", |
||||
[ |
||||
"theory painting academic academic armed sweater year military elder discuss acne wildlife boring employer fused large satoshi bundle carbon diagnose anatomy hamster leaves tracks paces beyond phantom capital marvel lips brave detect lunar" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"22. Mnemonic with invalid padding (256 bits)", |
||||
[ |
||||
"theory painting academic academic campus sweater year military elder discuss acne wildlife boring employer fused large satoshi bundle carbon diagnose anatomy hamster leaves tracks paces beyond phantom capital marvel lips facility obtain sister" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"23. Basic sharing 2-of-3 (256 bits)", |
||||
[ |
||||
"humidity disease academic always aluminum jewelry energy woman receiver strategy amuse duckling lying evidence network walnut tactics forget hairy rebound impulse brother survive clothes stadium mailman rival ocean reward venture always armed unwrap", |
||||
"humidity disease academic agency actress jacket gross physics cylinder solution fake mortgage benefit public busy prepare sharp friar change work slow purchase ruler again tricycle involve viral wireless mixture anatomy desert cargo upgrade" |
||||
], |
||||
"c938b319067687e990e05e0da0ecce1278f75ff58d9853f19dcaeed5de104aae" |
||||
], |
||||
[ |
||||
"24. Basic sharing 2-of-3 (256 bits)", |
||||
[ |
||||
"humidity disease academic always aluminum jewelry energy woman receiver strategy amuse duckling lying evidence network walnut tactics forget hairy rebound impulse brother survive clothes stadium mailman rival ocean reward venture always armed unwrap" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"25. Mnemonics with different identifiers (256 bits)", |
||||
[ |
||||
"smear husband academic acid deadline scene venture distance dive overall parking bracelet elevator justice echo burning oven chest duke nylon", |
||||
"smear isolate academic agency alpha mandate decorate burden recover guard exercise fatal force syndrome fumes thank guest drift dramatic mule" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"26. Mnemonics with different iteration exponents (256 bits)", |
||||
[ |
||||
"finger trash academic acid average priority dish revenue academic hospital spirit western ocean fact calcium syndrome greatest plan losing dictate", |
||||
"finger traffic academic agency building lilac deny paces subject threaten diploma eclipse window unknown health slim piece dragon focus smirk" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"27. Mnemonics with mismatching group thresholds (256 bits)", |
||||
[ |
||||
"flavor pink beard echo depart forbid retreat become frost helpful juice unwrap reunion credit math burning spine black capital lair", |
||||
"flavor pink beard email diet teaspoon freshman identify document rebound cricket prune headset loyalty smell emission skin often square rebound", |
||||
"flavor pink academic easy credit cage raisin crazy closet lobe mobile become drink human tactics valuable hand capture sympathy finger" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"28. Mnemonics with mismatching group counts (256 bits)", |
||||
[ |
||||
"column flea academic leaf debut extra surface slow timber husky lawsuit game behavior husky swimming already paper episode tricycle scroll", |
||||
"column flea academic agency blessing garbage party software stadium verify silent umbrella therapy decorate chemical erode dramatic eclipse replace apart" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"29. Mnemonics with greater group threshold than group counts (256 bits)", |
||||
[ |
||||
"smirk pink acrobat acid auction wireless impulse spine sprinkle fortune clogs elbow guest hush loyalty crush dictate tracks airport talent", |
||||
"smirk pink acrobat agency dwarf emperor ajar organize legs slice harvest plastic dynamic style mobile float bulb health coding credit", |
||||
"smirk pink beard academic alto strategy carve shame language rapids ruin smart location spray training acquire eraser endorse submit peaceful" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"30. Mnemonics with duplicate member indices (256 bits)", |
||||
[ |
||||
"fishing recover academic always device craft trend snapshot gums skin downtown watch device sniff hour clock public maximum garlic born", |
||||
"fishing recover academic always aircraft view software cradle fangs amazing package plastic evaluate intend penalty epidemic anatomy quarter cage apart" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"31. Mnemonics with mismatching member thresholds (256 bits)", |
||||
[ |
||||
"evoke garden academic academic answer wolf scandal modern warmth station devote emerald market physics surface formal amazing aquatic gesture medical", |
||||
"evoke garden academic agency deal revenue knit reunion decrease magazine flexible company goat repair alarm military facility clogs aide mandate" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"32. Mnemonics giving an invalid digest (256 bits)", |
||||
[ |
||||
"river deal academic acid average forbid pistol peanut custody bike class aunt hairy merit valid flexible learn ajar very easel", |
||||
"river deal academic agency camera amuse lungs numb isolate display smear piece traffic worthy year patrol crush fact fancy emission" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"33. Insufficient number of groups (256 bits, case 1)", |
||||
[ |
||||
"wildlife deal beard romp alcohol space mild usual clothes union nuclear testify course research heat listen task location thank hospital slice smell failure fawn helpful priest ambition average recover lecture process dough stadium" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"34. Insufficient number of groups (256 bits, case 2)", |
||||
[ |
||||
"wildlife deal decision scared acne fatal snake paces obtain election dryer dominant romp tactics railroad marvel trust helpful flip peanut theory theater photo luck install entrance taxi step oven network dictate intimate listen", |
||||
"wildlife deal decision smug ancestor genuine move huge cubic strategy smell game costume extend swimming false desire fake traffic vegan senior twice timber submit leader payroll fraction apart exact forward pulse tidy install" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"35. Threshold number of groups, but insufficient number of members in one group (256 bits)", |
||||
[ |
||||
"wildlife deal decision shadow analysis adjust bulb skunk muscle mandate obesity total guitar coal gravity carve slim jacket ruin rebuild ancestor numerous hour mortgage require herd maiden public ceiling pecan pickup shadow club", |
||||
"wildlife deal beard romp alcohol space mild usual clothes union nuclear testify course research heat listen task location thank hospital slice smell failure fawn helpful priest ambition average recover lecture process dough stadium" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"36. Threshold number of groups and members in each group (256 bits, case 1)", |
||||
[ |
||||
"wildlife deal ceramic round aluminum pitch goat racism employer miracle percent math decision episode dramatic editor lily prospect program scene rebuild display sympathy have single mustang junction relate often chemical society wits estate", |
||||
"wildlife deal decision scared acne fatal snake paces obtain election dryer dominant romp tactics railroad marvel trust helpful flip peanut theory theater photo luck install entrance taxi step oven network dictate intimate listen", |
||||
"wildlife deal ceramic scatter argue equip vampire together ruin reject literary rival distance aquatic agency teammate rebound false argue miracle stay again blessing peaceful unknown cover beard acid island language debris industry idle", |
||||
"wildlife deal ceramic snake agree voter main lecture axis kitchen physics arcade velvet spine idea scroll promise platform firm sharp patrol divorce ancestor fantasy forbid goat ajar believe swimming cowboy symbolic plastic spelling", |
||||
"wildlife deal decision shadow analysis adjust bulb skunk muscle mandate obesity total guitar coal gravity carve slim jacket ruin rebuild ancestor numerous hour mortgage require herd maiden public ceiling pecan pickup shadow club" |
||||
], |
||||
"5385577c8cfc6c1a8aa0f7f10ecde0a3318493262591e78b8c14c6686167123b" |
||||
], |
||||
[ |
||||
"37. Threshold number of groups and members in each group (256 bits, case 2)", |
||||
[ |
||||
"wildlife deal decision scared acne fatal snake paces obtain election dryer dominant romp tactics railroad marvel trust helpful flip peanut theory theater photo luck install entrance taxi step oven network dictate intimate listen", |
||||
"wildlife deal beard romp alcohol space mild usual clothes union nuclear testify course research heat listen task location thank hospital slice smell failure fawn helpful priest ambition average recover lecture process dough stadium", |
||||
"wildlife deal decision smug ancestor genuine move huge cubic strategy smell game costume extend swimming false desire fake traffic vegan senior twice timber submit leader payroll fraction apart exact forward pulse tidy install" |
||||
], |
||||
"5385577c8cfc6c1a8aa0f7f10ecde0a3318493262591e78b8c14c6686167123b" |
||||
], |
||||
[ |
||||
"38. Threshold number of groups and members in each group (256 bits, case 3)", |
||||
[ |
||||
"wildlife deal beard romp alcohol space mild usual clothes union nuclear testify course research heat listen task location thank hospital slice smell failure fawn helpful priest ambition average recover lecture process dough stadium", |
||||
"wildlife deal acrobat romp anxiety axis starting require metric flexible geology game drove editor edge screw helpful have huge holy making pitch unknown carve holiday numb glasses survive already tenant adapt goat fangs" |
||||
], |
||||
"5385577c8cfc6c1a8aa0f7f10ecde0a3318493262591e78b8c14c6686167123b" |
||||
], |
||||
[ |
||||
"39. Mnemonic with insufficient length", |
||||
[ |
||||
"junk necklace academic academic acne isolate join hesitate lunar roster dough calcium chemical ladybug amount mobile glasses verify cylinder" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"40. Mnemonic with invalid master secret length", |
||||
[ |
||||
"fraction necklace academic academic award teammate mouse regular testify coding building member verdict purchase blind camera duration email prepare spirit quarter" |
||||
], |
||||
"" |
||||
], |
||||
[ |
||||
"41. Valid mnemonics which can detect some errors in modular arithmetic", |
||||
[ |
||||
"herald flea academic cage avoid space trend estate dryer hairy evoke eyebrow improve airline artwork garlic premium duration prevent oven", |
||||
"herald flea academic client blue skunk class goat luxury deny presence impulse graduate clay join blanket bulge survive dish necklace", |
||||
"herald flea academic acne advance fused brother frozen broken game ranked ajar already believe check install theory angry exercise adult" |
||||
], |
||||
"ad6f2ad8b59bbbaa01369b9006208d9a" |
||||
] |
||||
] |
||||
Loading…
Reference in new issue