WIP: Add pbkfd2 implementation

Author: evanlinjin

Cargo.toml

@@ -33,10 +33,7 @@ rocksdb = { version = "0.14", default-features = false, features = ["snappy"], o
 cc = { version = ">=1.0.64", optional = true }
 socks = { version = "0.3", optional = true }
 lazy_static = { version = "1.4", optional = true }
-pbkdf2 = { version = "0.10", optional = true }
 unicode-normalization = { version = "0.1.19", optional = true }
-sha2 = { version = "0.10.2", optional = true }
-hmac = { version = "0.12.1", optional = true }
 
 bitcoinconsensus = { version = "0.19.0-3", optional = true }
 
@@ -63,7 +60,7 @@ compact_filters = ["rocksdb", "socks", "lazy_static", "cc"]
 key-value-db = ["sled"]
 all-keys = ["keys-bip39"]
 rpc = ["bitcoincore-rpc"]
-keys-bip39 = ["pbkdf2", "unicode-normalization", "sha2", "hmac"]
+keys-bip39 = ["unicode-normalization"]
 
 # Languages for BIP39 mnemonics. English is always included by default
 japanese = []

src/keys/bip39/mod.rs

@@ -18,8 +18,6 @@ use bitcoin::{
     hashes::{sha256, Hash},
     util::bip32,
 };
-use hmac::Hmac;
-use sha2::Sha512;
 use unicode_normalization::UnicodeNormalization;
 
 use miniscript::ScriptContext;
@@ -28,6 +26,7 @@ use super::{
     any_network, DerivableKey, DescriptorKey, ExtendedKey, GeneratableKey, GeneratedKey, KeyError,
 };
 
+mod pbkdf2;
 mod wordlists;
 pub use wordlists::Language;
 
@@ -206,32 +205,11 @@ impl Mnemonic {
 
     /// Convert a mnemonic to a seed with an optional passphrase
     fn to_seed(&self, passphrase: Option<String>) -> [u8; 64] {
-        const PBKDF2_ITERATIONS: u32 = 2048;
-        const PBKDF2_BYTES: usize = 64;
-
-        let password = self
-            .word_iter()
-            .collect::<Vec<&str>>()
-            .join(" ")
-            .nfkd()
-            .collect::<String>();
-        let salt = ("mnemonic".to_string() + &passphrase.unwrap_or_else(|| "".to_string()))
-            .nfkd()
-            .collect::<String>();
-
-        let mut seed = [0u8; PBKDF2_BYTES];
-        pbkdf2::pbkdf2::<Hmac<Sha512>>(
-            password.as_bytes(),
-            salt.as_bytes(),
-            PBKDF2_ITERATIONS,
-            &mut seed,
-        );
-
-        seed
+        pbkdf2::make_seed(self, passphrase)
     }
 
     /// Convert a vec of word indices to an iterator of the mnemonic words
-    fn word_iter(&self) -> impl Iterator<Item = &str> + '_ {
+    fn word_iter(&self) -> impl Iterator<Item = &str> + Clone + '_ {
         let wordlist = self.language.wordlist();
         self.words.iter().map(move |&w| wordlist[w as usize])
     }
@@ -599,7 +577,7 @@ mod test {
                     .to_string(),
                 generated_mnemonic.to_string()
             );
-            assert_eq!(generated_seed[..], seed[..]);
+            assert_eq!(generated_seed[..], seed[..], "mnemonic: {}", vector[1]);
             assert_eq!(generated_privkey.to_string(), xprivkey);
         }
     }

src/keys/bip39/pbkdf2.rs

@@ -0,0 +1,72 @@
+use std::borrow::Cow;
+
+use bitcoin::hashes::{sha512, Hash, HashEngine, Hmac, HmacEngine};
+use unicode_normalization::UnicodeNormalization;
+
+use super::Mnemonic;
+
+const SALT_PREFIX: &str = "mnemonic";
+const SEED_LEN: usize = 64;
+const PBKDF2_ITERATIONS: u32 = 2048;
+
+// prf
+fn pseudo_random_function(key: &[u8], data: &[u8]) -> Hmac<sha512::Hash> {
+    let mut engine = HmacEngine::new(key);
+    engine.input(data);
+    Hmac::from_engine(engine)
+}
+
+// c: iterations
+// p: password
+// s: salt
+// i: block index
+fn xor_sum(p: &str, s: &str, c: u32, i: u32) -> [u8; sha512::Hash::LEN] {
+    let mut data = Vec::with_capacity(s.len() + 4);
+    data.extend_from_slice(s.as_bytes());
+    data.extend_from_slice(&i.to_be_bytes());
+
+    let mut xor_res = [0_u8; sha512::Hash::LEN];
+
+    for _ in 0..c {
+        let u = pseudo_random_function(p.as_bytes(), &data).into_inner();
+        data.clone_from(&u.to_vec());
+
+        // xor
+        xor_res.iter_mut().zip(&u).for_each(|(a, b)| *a ^= b);
+    }
+
+    xor_res
+}
+
+fn pbkd2_hmac_sha512(p: &str, s: &str, c: u32, dk: &mut [u8]) {
+    for (i, chunk) in dk.chunks_mut(sha512::Hash::LEN).enumerate() {
+        chunk.copy_from_slice(&xor_sum(p, s, c, (i + 1) as _));
+    }
+}
+
+fn make_password(mnemonic: &Mnemonic) -> String {
+    mnemonic
+        .word_iter()
+        .collect::<Vec<&str>>()
+        .join(" ")
+        .nfkd()
+        .to_string()
+}
+
+fn make_salt(passphrase: Option<String>) -> Cow<'static, str> {
+    let mut salt = Cow::from(SALT_PREFIX);
+    if let Some(passphrase) = passphrase {
+        salt.to_mut()
+            .push_str(&passphrase.nfkd().collect::<String>());
+    }
+    salt
+}
+
+pub(crate) fn make_seed(mnemonic: &Mnemonic, passphrase: Option<String>) -> [u8; SEED_LEN] {
+    let password = make_password(mnemonic);
+    let salt = make_salt(passphrase);
+
+    let mut dk = [0_u8; SEED_LEN];
+    pbkd2_hmac_sha512(&password, &salt, PBKDF2_ITERATIONS, &mut dk);
+    dk
+}