Bitcoin.Protocol.Signature

Signing, verifying, and encoding/decoding of signatures.

types

data Signature

An ECDSA signature

Constructors

Signature

Fields

• _signatureR :: !Integer
• _signatureS :: !Integer

Instances

Eq Signature

Methods

(==) :: Signature -> Signature -> Bool

(/=) :: Signature -> Signature -> Bool

Show Signature

Methods

showsPrec :: Int -> Signature -> ShowS

show :: Signature -> String

showList :: [Signature] -> ShowS

data SignatureExt

"Extended signature": an ECDSA signature together with the sighash type

Constructors

SignatureExt

Fields

• _extSignature :: !Signature
• _extSigHash :: !SigHash

Instances

Eq SignatureExt

Methods

(==) :: SignatureExt -> SignatureExt -> Bool

(/=) :: SignatureExt -> SignatureExt -> Bool

Show SignatureExt

Methods

showsPrec :: Int -> SignatureExt -> ShowS

show :: SignatureExt -> String

showList :: [SignatureExt] -> ShowS

newtype SignBits

Two extra bits of information, used to recover the public key from the signatures.

Constructors

SignBits Word8

Instances

Eq SignBits

Methods

(==) :: SignBits -> SignBits -> Bool

(/=) :: SignBits -> SignBits -> Bool

Show SignBits

Methods

showsPrec :: Int -> SignBits -> ShowS

show :: SignBits -> String

showList :: [SignBits] -> ShowS

data SigHash

SigHash specifies how to the OP_CHECKSIG opcode should work (?)

Constructors

SigHash

Fields

• _sigHashType :: !SigHashType
• _anyOneCanPay :: !Bool

Instances

Eq SigHash

Methods

(==) :: SigHash -> SigHash -> Bool

(/=) :: SigHash -> SigHash -> Bool

Show SigHash

Methods

showsPrec :: Int -> SigHash -> ShowS

show :: SigHash -> String

showList :: [SigHash] -> ShowS

data SigHashType

Constructors

SigHashAll

SigHashNone

SigHashSingle

SigHashAllZero

0 appears in the blockchain, should be handled as SigHashAll, but we must also properly serialize it back to 0 :(

Instances

Eq SigHashType

Methods

(==) :: SigHashType -> SigHashType -> Bool

(/=) :: SigHashType -> SigHashType -> Bool

Show SigHashType

Methods

showsPrec :: Int -> SigHashType -> ShowS

show :: SigHashType -> String

showList :: [SigHashType] -> ShowS

sigHashAll :: SigHash

normalizeSigHashType :: SigHashType -> SigHashType

Converts SigHashAllZero to SigHashAll

normalizeSigHash :: SigHash -> SigHash

SigHash encoding

encodeSigHash :: SigHash -> Word8

decodeSigHash :: Word8 -> Maybe SigHash

DER signature encoding

encodeSignatureDER :: OctetStream a => SignatureExt -> a

Signatures use DER encoding to pack the r and s components into a single byte stream (this is also what OpenSSL produces by default). (it seem that this is true only in the blockchain, not for signatures of messages, which use CompactSig?)

Howeever, there is an extra last byte appended, which is "SIGHASH"

decodeSignatureDER :: OctetStream a => a -> Maybe SignatureExt

decodeSignatureDER' :: OctetStream a => Bool -> a -> Maybe SignatureExt

DER encoding looks like this:

0x30 len [ 0x02 lenR [ R ] 0x02 lenS [ S ] ] SIGHASH

so that's 7 extra bytes on top of R and S.

Except when it doesn't look it that... (mostly in MULTISIG transactions). Of course nothing is documented anywhere.

So the Bool argument controls if we are playing strict (True) or loose (False)

"compact" signature encoding

decodeCompactSigBase64 :: Base64 -> Maybe (PubKeyFormat, SignBits, Signature)

Decodes a base64-encoded "compact" signature

encodeCompactSigBase64 :: (PubKeyFormat, SignBits, Signature) -> Base64

decodeCompactSig :: OctetStream a => a -> Maybe (PubKeyFormat, SignBits, Signature)

Decodes a 65 bytes long "compact" signature.

First byte is either one of 0x1b, 0x1c, 0x1d, 0x1e (uncompressed public key) or 0x1f, 0x20, 0x21, 0x22 (compressed public key). This information is necessary to recover the public key from the message hash and the signature. In the output only the relevant two bits of information is retained.

After that comes 32 bytes R and 32 bytes S.

encodeCompactSig :: OctetStream a => (PubKeyFormat, SignBits, Signature) -> a

About the Word8: Bit 0 encodes whether the curve point R (which has x coordinate r from the signature) has even or odd y coordinate; and bit 1 encodes how to reconstruct the x coordinate from r. The rest of the bits must be zero

signing messages (user specified random generator)

signTextMessage :: (OctetStream msg, RandomGen gen) => PrivKey -> msg -> gen -> ((SignBits, Signature), gen)

Signing a bitcoin-QT compatible text message

signRawMessage :: (OctetStream msg, RandomGen gen) => PrivKey -> msg -> gen -> ((SignBits, Signature), gen)

signTextMessageAddr_ :: (OctetStream msg, RandomGen gen) => PubKeyFormat -> PrivKey -> msg -> gen -> (Base64, gen)

signTextMessageAddr :: (OctetStream msg, RandomGen gen) => PubKeyFormat -> PrivKey -> msg -> gen -> ((Address, Base64), gen)

Bitcoin-QT compatible message signing (can be checked with the address instead of the public key)

signing messages (default random generator in IO - primarily for testing)

signTextMessageIO :: OctetStream msg => PrivKey -> msg -> IO (SignBits, Signature)

Signing a bitcoin-QT compatible text message (using the default random number generator in IO).

signRawMessageIO :: OctetStream msg => PrivKey -> msg -> IO (SignBits, Signature)

signTextMessageAddrIO_ :: OctetStream msg => PubKeyFormat -> PrivKey -> msg -> IO Base64

signTextMessageAddrIO :: OctetStream msg => PubKeyFormat -> PrivKey -> msg -> IO (Address, Base64)

Bitcoin-QT compatible message signing with the default random generator (can be checked with the address instead of the public key)

signing messages (RFC6979 deterministic signatures)

signTextMessageRFC6979 :: OctetStream msg => PrivKey -> msg -> (SignBits, Signature)

Signing a bitcoin-QT compatible text message using the deterministic RFC6979 signatures.

signRawMessageRFC6979 :: OctetStream msg => PrivKey -> msg -> (SignBits, Signature)

Signing a raw (octet stream) message using the deterministic RFC6979 signatures.

signTextMessageAddrRFC6979_ :: OctetStream msg => PubKeyFormat -> PrivKey -> msg -> Base64

signTextMessageAddrRFC6979 :: OctetStream msg => PubKeyFormat -> PrivKey -> msg -> (Address, Base64)

Bitcoin-QT compatible message signing (can be checked with the address instead of the public key), using the deterministic RFC6979 signatures.

verifying signatures

verifyTextSignatureAddr :: OctetStream msg => Address -> Base64 -> msg -> Bool

First argument is the address, second is the base64-encoded "compact signature", third is the message.

TODO: UTF8 encoding!

verifyTextSignaturePK :: OctetStream msg => PubKey -> Signature -> msg -> Bool

Verifying a bitcoin-QT compatible text signature using the public key

verifyRawSignaturePK :: OctetStream msg => PubKey -> Signature -> msg -> Bool

Verifying a signature for raw data (no bitcoin-QT magic wrapper around the message)

public key recovery

recoverTextPubKey :: OctetStream msg => (PubKeyFormat, SignBits, Signature) -> msg -> Maybe PubKey

Recovers the public key from the compact signature and the text message (Bitcoin-QT compatible)

recoverRawPubKey :: OctetStream msg => (PubKeyFormat, SignBits, Signature) -> msg -> Maybe PubKey

Recovers the public key from the compact signature and the raw message (no Bitcoin-QT magic)

text message signing (bitcoin-qt compatible)

messageMagic :: ByteString

This is prepended to the message. Only it is not simply prepended...

prepareMessageForSigning :: OctetStream a => a -> ByteString

Now, this is a seriously braindead and completely undocumented protocol

messageHash :: OctetStream msg => Bool -> msg -> Hash256

The message hash function we use for signing message.

The bool parameter specifies whether to sign the raw message or the really stupidly serialized and magic prefixed text version...