diff --git a/bip-0460.mediawiki b/bip-0460.mediawiki new file mode 100644 index 00000000..cdcaf1bd --- /dev/null +++ b/bip-0460.mediawiki @@ -0,0 +1,576 @@ +
+  BIP: 460
+  Layer: Consensus (soft fork)
+  Title: CISA for Taproot Key Path Spends in SegWit v2
+  Authors: Fabian Jahr 
+  Status: Draft
+  Type: Specification
+  Assigned: 2026-07-28
+  License: CC0-1.0 OR MIT
+  Discussion: 2026-07-18: https://groups.google.com/g/bitcoindev/c/1XH6sBLWZuA
+  Requires: 340, 341, 458, 459
+
+ +== Introduction == + +=== Abstract === + +This document proposes cross-input signature aggregation (CISA) for Bitcoin transactions. +A new witness version (v2) enables Taproot-style key path spending with two Schnorr signature aggregation schemes: half-aggregation and full-aggregation. +Half-aggregation non-interactively reduces ''n'' signatures from ''64*n'' bytes to ''(n+1)*32'' bytes, while full-aggregation reduces them to a constant 64 bytes but requires interactive signing. +Aggregated inputs carry their share of the aggregate signature data and optionally a sighash type, with a marker byte indicating the aggregation mode (half-agg or full-agg) on the last input of each group, while opted-out inputs carry a plain BIP 341 signature. +The opt-out mode exists for protocols that depend on a specific signature appearing on chain, such as some adaptor signature protocols. + +=== Copyright === + +This document, along with the [[bip-0460/test-vectors.py|test vector generator]] and test vectors, is licensed under CC0-1.0 or the MIT License, at your option. +The vendored copy of the secp256k1lab library in [[bip-0460/secp256k1lab/|bip-0460/secp256k1lab]] is licensed under the MIT License only, as stated in its [[bip-0460/secp256k1lab/COPYING|COPYING]] file. + +=== Motivation === + +Signature data makes up a large share of Bitcoin transaction sizes. +Each Taproot key path spend requires a 64-byte [[bip-0340.mediawiki|BIP 340]] Schnorr signature, so transactions with many inputs spend much of their weight on signatures. + +The linearity of Schnorr signatures allows combining multiple signatures into a more compact form. +Cross-input signature aggregation applies this to the signatures of different inputs within one transaction. + +This provides: + +* '''Lower fees and smaller transactions''': Signature data shrinks with the number of aggregated inputs, reducing transaction weight and fees and freeing up block space +* '''Reduced cost of privacy''': Aggregation reduces the signature cost of any batched transaction, and collaborative transactions such as CoinJoin and PayJoin benefit the most per participant because they batch the inputs of many users +* '''Flexible usage''': Two aggregation schemes serve different use cases and individual inputs can opt out +* '''Protocol compatibility''': The opt-out protects protocols that depend on a specific signature appearing on chain +* '''Low initial adoption cost''': Opted-out spends are plain BIP 341 key path spends, so wallets that do not aggregate can adopt witness v2 outputs without new signing logic + +Use cases include: + +* '''CoinJoin/PayJoin transactions''': With CISA, the per-participant cost of CoinJoin and PayJoin transactions decreases as the number of participants increases, making privacy-enhancing usage cheaper +* '''Consolidation and batching''': Businesses and users combining many small UTXOs into a single output or multiple payment outputs benefit from reduced transaction costs +* '''Lightning channel opens and splices''': Dual funding and splicing combine inputs from both peers in a collaborative transaction, and the existing interactive negotiation between the peers can accommodate the signing rounds of full-aggregation + +Aside from these use cases, any transaction spending more than one witness v2 input benefits from CISA through fee savings. + +== Design == + +This BIP introduces a new witness version (v2) that enables signature aggregation for Taproot-style key path spends. +The design reuses the existing Taproot and tapscript machinery wherever possible and makes aggregation opt-in on a per-input basis, so witness v2 outputs can be adopted independently of whether aggregation is used. +Both aggregation schemes are supported, inputs can opt out, and aggregation is limited to key path spends. +The reasoning behind these decisions is covered in the [[#rationale|Rationale]] section. + +The main design decision is that every aggregated witness v2 key path input carries only its share of the aggregate signature data plus an optional sighash byte, while opted-out inputs carry a plain BIP 341 signature. +The last input in each aggregation group completes the aggregate signature and tags it with a marker byte identifying the scheme. +This design: + +* Shows which inputs participate in aggregation +* Lets each input specify its own sighash type +* Allows mixing aggregated, opted-out, and non-aggregated inputs in the same transaction +* Commits to the aggregation mode in the signature message, protecting opted-out inputs from non-consensual aggregation by third parties +* Supports half-aggregation and full-aggregation within the same transaction (as separate groups, one per scheme) + +== Specification == + +=== Witness version 2 === + +Witness version 2 outputs are created with a scriptPubKey of OP_2 <32-byte witness program> (or 0x5220{32-byte witness program}). + +Validation of witness v2 spends is identical to the witness version 1 rules of [[bip-0341.mediawiki|BIP 341]], with the following modifications for key path spends: + +* The single witness stack element remaining after removal of the optional annex is only interpreted as a signature if it is 64 bytes long, or 65 bytes long with a last byte that is not a marker byte. Otherwise its interpretation follows the aggregation forms defined below. +* For inputs that participate in aggregation, the key path signature message and signature verification are replaced by the rules defined below. + +All other rules apply unchanged. +In particular script path spending and its upgrade mechanisms, annex handling, and the treatment of witness programs that are not exactly 32 bytes long or are wrapped in P2SH follow BIP 341. +Signatures inside script path spends are not aggregated under this BIP. + +=== Marker definitions === + +This BIP defines two marker bytes for the final inputs of the aggregation groups: + +* 0xbc: '''Half-aggregation marker'''. The input completes the half-aggregation group. +* 0xbd: '''Full-aggregation marker'''. The input completes the full-aggregation group. + +The marker is the last byte of the final input's witness element. +The marker byte is not an opcode, since a key path witness element is not script. +The only structural constraint is that markers must be disjoint from the valid sighash types, so that a 65-byte witness element ending in a marker can never be a valid BIP 341 signature. +A 64-byte element is always an opted-out signature, since no marked form has that length. +The chosen values fall into the range 0xbb to 0xfe, which is unassigned in legacy script and corresponds to OP_SUCCESS opcodes in tapscript, so they do not collide with opcodes commonly seen in scripts. + +Opted-out inputs and aggregation group members carry no marker. +An opted-out witness element is a 64-byte or 65-byte BIP 341 signature, and member elements are identified by their length. +A key path spend whose witness element is neither such a signature nor one of the aggregation forms defined below is invalid. +Undefined marker values cannot serve as an upgrade hook because witness data is not committed to by the output. +A marker value that validated unconditionally would make every witness v2 output spendable by anyone. +Future aggregation modes are therefore expected to be introduced through new witness versions or new leaf versions instead of new marker values. + +=== Witness structure === + +Aggregation changes only the content of the witness. +The transaction format is unchanged. +A transaction may contain at most two aggregation groups: one half-aggregation group and one full-aggregation group. +Aggregated and non-aggregated inputs can be mixed in any order, with the constraint that all members of a group must appear before the input carrying the group's marker. +The input carrying a group's marker is called the ''final input'' of the group, all other aggregated inputs are called ''members''. +Only witness v2 key path spends can participate in aggregation groups. +Inputs spending other output types, as well as witness v2 script path spends and opted-out key path spends, are validated independently under their own rules and can be combined freely with aggregated inputs in the same transaction. + +Each witness v2 key path spend uses a single witness element (plus optional annex). +For opted-out inputs this element is a 64-byte or 65-byte BIP 341 signature. +For aggregated inputs it consists of the input's share of the aggregate signature data, an optional sighash byte, and the marker on the final input: + +* '''Signature data''': The 32-byte nonce share for half-aggregation members, nothing for full-aggregation members, and the completion of the aggregate signature for final inputs +* '''Sighash type''': Optional byte following the signature data. If absent, SIGHASH_DEFAULT (0x00) is used'''Why does the marker follow the sighash byte and the signature data?''' Traditionally the sighash byte is appended to the signature, as in the 65-byte signatures of BIP 341, and this BIP keeps that order. Placing the marker last, in the position of the sighash byte, is what allows opted-out inputs to use unchanged BIP 341 signatures. A 65-byte element ending in a valid sighash byte is an opted-out signature and one ending in a marker is an aggregation group final, and no marked form is 64 bytes long. With the marker in front, a 65-byte element could be either an opted-out signature with a sighash byte or a full-aggregation final without one. +* '''Marker''': Last byte of the final input's element (0xbc or 0xbd) + +The marker and the length of the witness element together determine its interpretation: + +{| class="wikitable" +|+ Valid witness element forms by marker and length +|- +! Marker !! Length !! Content !! Interpretation +|- +| none || 64 bytes || 64-byte signature || Opted-out, SIGHASH_DEFAULT +|- +| none || 65 bytes || 64-byte signature and sighash || Opted-out, explicit sighash +|- +| none || 0 bytes || none || Full-aggregation member, SIGHASH_DEFAULT +|- +| none || 1 byte || sighash || Full-aggregation member, explicit sighash +|- +| none || 32 bytes || nonce share || Half-aggregation member, SIGHASH_DEFAULT +|- +| none || 33 bytes || nonce share and sighash || Half-aggregation member, explicit sighash +|- +| 0xbc || 65 bytes || nonce share and 32-byte ''s'' value || Half-aggregation final, SIGHASH_DEFAULT +|- +| 0xbc || 66 bytes || nonce share, ''s'' value, and sighash || Half-aggregation final, explicit sighash +|- +| 0xbd || 65 bytes || 64-byte signature || Full-aggregation final, SIGHASH_DEFAULT +|- +| 0xbd || 66 bytes || 64-byte signature and sighash || Full-aggregation final, explicit sighash +|} + +All forms have a fixed length. +A witness element whose marker and length combination matches no row of this table is invalid. +Opted-out elements have no marker, so a 64-byte element is an opted-out signature even if its last byte equals a marker value, and a 65-byte element is an opted-out signature unless its last byte is a marker. +Only 65-byte and 66-byte elements are interpreted against the marker. +In the 1-byte and 33-byte member forms the last byte is a sighash byte, so an element of those lengths ending in a marker value is a member with an invalid sighash type. + +In all forms with an explicit sighash byte the byte must not be 0x00. +SIGHASH_DEFAULT can only be expressed by omitting the sighash byte. +This mirrors the rule for 65-byte signatures in BIP 341 and ensures that every signature message has exactly one witness encoding, preventing third parties from malleating the wtxid by switching between equivalent encodings. + +=== Signature message === + +The signature message of an aggregated input commits to the input's aggregation mode in addition to the transaction data. +Let ''SigMsg(hash_type, ext_flag)'' be the common signature message function defined in BIP 341, including all of its failure conditions. +For an aggregated witness v2 key path spend with sighash type ''hash_type'', the message is computed as: + + +m = hash_TapSighash(0x01 || agg_mode || SigMsg(hash_type, 0)) + + +The first byte is the sighash epoch. +BIP 341 messages use epoch 0x00 and reserve other values for signature algorithms that make invasive changes to how hashing is performed, such as this one. +The ''agg_mode'' byte is the marker byte of the input's group (0xbc for half-aggregation, 0xbd for full-aggregation). +Opted-out inputs use the unchanged BIP 341 message ''hash_TapSighash(0x00 || SigMsg(hash_type, 0))''.'''Why do opted-out inputs keep sighash epoch 0x00?''' The epoch identifies the message computation, not the witness version, and other values are reserved for algorithms that change how hashing is performed. Opted-out spends leave the computation unchanged, so a different epoch would force wallets that do not aggregate to implement a second signing code path without a security benefit. Replaying the resulting signatures across witness versions is not possible because SigMsg commits to the scriptPubKey of the output being spent. Keeping epoch 0x00 also means that a hypothetical witness v2 output type following the BIP 341 rules unchanged would produce the exact same key path spends as the opt-out mode of this BIP. + +Committing to the aggregation mode makes aggregation consensual. +A signature created for an opted-out input is not valid as a member of an aggregation group and vice versa. +Without this commitment any third party could fold an opted-out signature into the half-aggregation group unchanged, because half-aggregation of existing signatures is a public operation. +See [[#why-no-opt-out-marker|Why no opt-out marker]] for details. + +Valid sighash types are: + +* 0x00: SIGHASH_DEFAULT (only expressible by omitting the sighash byte) +* 0x01: SIGHASH_ALL +* 0x02: SIGHASH_NONE +* 0x03: SIGHASH_SINGLE +* 0x81: SIGHASH_ALL | SIGHASH_ANYONECANPAY +* 0x82: SIGHASH_NONE | SIGHASH_ANYONECANPAY +* 0x83: SIGHASH_SINGLE | SIGHASH_ANYONECANPAY + +Note: SIGHASH_ANYONECANPAY composes with aggregation only partially, see [[#usage-of-anyonecanpay|Usage of ANYONECANPAY]]. + +=== Opted-out key path spends === + +An opted-out witness v2 key path spend has a witness stack containing: + +* '''Without annex''': [signature] (64 bytes) or [signature || sighash] (65 bytes) +* '''With annex''': [signature] [0x50...] or [signature || sighash] [0x50...] + +Validation proceeds exactly as for a BIP 341 key path spend, using the BIP 341 signature message and BIP 340 signature verification against the output key. + +=== Aggregated key path spends === + +The aggregate signature data of a group is split across the witness elements of its inputs. + +'''Half-aggregation members:''' + +* '''Without annex''': [nonce share] (32 bytes) or [nonce share || sighash] (33 bytes) +* '''With annex''': [nonce share] [0x50...] or [nonce share || sighash] [0x50...] + +The nonce share of an input is the first 32 bytes of its individual BIP 340 signature, see [[#signing|Signing]]. + +'''Half-aggregation final input:''' + +* '''Without annex''': [nonce share || s || 0xbc] (65 bytes) or [nonce share || s || sighash || 0xbc] (66 bytes) +* '''With annex''': [nonce share || s || 0xbc] [0x50...] or [nonce share || s || sighash || 0xbc] [0x50...] + +The nonce shares of all group inputs in input order, followed by the ''s'' value from the final input, form the ''(n+1)*32''-byte aggregate signature of [[bip-0458.mediawiki|BIP 458]]. + +'''Full-aggregation members:''' + +* '''Without annex''': [] (empty element) or [sighash] (1 byte) +* '''With annex''': [] [0x50...] or [sighash] [0x50...] + +The empty element is a single witness stack item of length zero. +A witness stack without any items remains invalid, see BIP 341. + +'''Full-aggregation final input:''' + +* '''Without annex''': [signature || 0xbd] (65 bytes) or [signature || sighash || 0xbd] (66 bytes) +* '''With annex''': [signature || 0xbd] [0x50...] or [signature || sighash || 0xbd] [0x50...] + +The signature is the 64-byte aggregate signature of [[bip-0459.mediawiki|BIP 459]]. + +An aggregation group may consist of a single input. +In that case the group's only input is its final input. + +=== Validation rules === + +Witness v2 key path spends are validated in three passes: + +'''Pass 1: Parse and collect aggregation information''' + +For each witness v2 key path spend: + +1. '''Extract annex if present''': +* If the witness stack has at least two elements, and the first byte of the last element is 0x50, this last element is the annex and is removed from the witness stack + +2. '''Parse the witness element''': +* If the element is 64 bytes long, or 65 bytes long and its last byte is not 0xbc or 0xbd, it is an opted-out signature and is parsed per BIP 341 +* Otherwise the length determines the structure per the table above, where 65-byte and 66-byte elements must end in a marker byte. Fail if the combination matches no defined structure +* Extract ''hash_type'' and signature data if present +* Verify ''hash_type'' is valid (0x01-0x03, 0x81-0x83 in explicit form). Fail on an explicit 0x00 + +3. '''Classify input''': +* '''64-byte or 65-byte signature''': Opted-out input +* '''Empty, 1-byte, 32-byte, or 33-byte element''': Aggregation member +* '''65-byte or 66-byte element ending in 0xbc or 0xbd''': Final input of that marker's group + +The structure table is exhaustive, so every witness element that parses successfully falls into exactly one class. + +'''Pass 2: Validate aggregation group structure''' + +Group formation rules: +* The half-aggregation group consists of the 32-byte and 33-byte members and the 0xbc final input +* The full-aggregation group consists of the empty and 1-byte members and the 0xbd final input +* Fail if a group has members but no final input, or more than one final input +* Fail if a member of a group appears after that group's final input +* Opted-out inputs do not form groups + +'''Pass 3: Verify signatures''' + +1. '''For each opted-out input''': +* Compute the message ''m = hash_TapSighash(0x00 || SigMsg(hash_type, 0))'' as in BIP 341 +* Verify the 64-byte signature using BIP 340 against the output key (the 32-byte witness program of the spent output) + +2. '''For each aggregation group''': +* Collect the group's inputs, consisting of its members and its final input +* Order the group's (pubkey, message) pairs by input index, where the pubkey of each pair is the 32-byte witness program of the spent output +* For each aggregated input ''i'': compute ''mi = hash_TapSighash(0x01 || marker || SigMsg(hash_typei, 0))'' +* For half-agg: assemble the aggregate signature as the concatenation of the group's nonce shares in input order followed by the ''s'' value of the final input +* For half-agg: verify the assembled aggregate signature with ''VerifyAggregate(aggsig, pm_aggd)'' as defined in [[bip-0458.mediawiki|BIP 458]], where ''pm_aggd'' is the ordered list of pairs +* For full-agg: verify the final input's 64-byte signature with ''Verify'' as defined in [[bip-0459.mediawiki|BIP 459]] over the ordered pubkey and message lists + +=== Signing === + +Signers of aggregated inputs compute the signature message defined above with the marker byte of their group as ''agg_mode''. +The secret key is the Taproot tweaked private key corresponding to the 32-byte witness program, derived as in BIP 341. + +'''Opted-out inputs''': +The signer creates a BIP 341 key path signature exactly as for a Taproot output. + +'''Half-aggregated inputs''': +Each signer creates an ordinary BIP 340 signature over its message in a single stateless pass. +The first 32 bytes of the signature are the input's nonce share, which can be placed in the member's witness element as soon as the signature exists. +The ''s'' parts of the individual signatures do not appear on chain. +Once all signatures of the group are available, any party can combine them with ''Aggregate'' or ''IncAggregate'' as defined in [[bip-0458.mediawiki|BIP 458]], over the group's pairs ordered by input index, and place the last 32 bytes of the result as the ''s'' value in the final input's witness element. +The aggregating party should verify the individual signatures first. +This identifies a disruptive signer and is necessary because ''Aggregate'' does not validate its inputs, see BIP 458. + +'''Full-aggregated inputs''': +The group's signers run the interactive signing protocol of [[bip-0459.mediawiki|BIP 459]]. +The public key list of the session is the ordered list of the group's 32-byte witness programs and the message list contains the corresponding signature messages in the same order. +Each signer uses its tweaked secret key, see the [[bip-0459.mediawiki#key-tweaking|Key Tweaking]] section of BIP 459. +The 64-byte signature returned by ''SigAgg'' is placed in the final input's witness element. +Any change that affects a group member's signature message or the group's ordered member list invalidates the session and requires a new one. +Secret nonces must never be reused across signing sessions, see BIP 459. + +== Examples == + +The final input of each aggregation group carries the marker and the completion of the aggregate signature and therefore more witness weight than the other group members. +How this weight difference is accounted for between the participants of a collaborative transaction is a protocol level concern outside the scope of this BIP. + +'''Example 1: Three inputs, all half-aggregated with SIGHASH_DEFAULT''' + +Input 0 witness: [32-byte nonce share] # 32 bytes: half-agg member +Input 1 witness: [32-byte nonce share] # 32 bytes: half-agg member +Input 2 witness: [nonce share || s || 0xbc] # 65 bytes: half-agg final + +Total overhead: 1 marker byte +Signature size reduction: 192 bytes → 129 bytes + + +'''Example 2: Three inputs full-aggregated with SIGHASH_ALL''' + +Input 0 witness: [0x01] # 1 byte: full-agg member, SIGHASH_ALL +Input 1 witness: [0x01] # 1 byte: full-agg member, SIGHASH_ALL +Input 2 witness: [64-byte sig || 0x01 || 0xbd] # 66 bytes: full-agg final, SIGHASH_ALL + +Total overhead: 1 marker byte +Signature size reduction: 195 bytes → 68 bytes + + +'''Example 3: Witness v1 input alongside a witness v2 aggregation group''' + +Input 0 witness: [64-byte sig] # witness v1 (Taproot) key path spend +Input 1 witness: [32-byte nonce share] # 32 bytes: half-agg member +Input 2 witness: [nonce share || s || 0xbc] # 65 bytes: half-agg final + +Input 0 spends a Taproot output and does not participate in aggregation. +Inputs 1 and 2 form the half-aggregation group. + +Total overhead: 1 marker byte +Signature size reduction (v2 inputs): 128 bytes → 97 bytes + + +'''Example 4: Mixed transaction''' + +Input 0 witness: [64-byte sig] # 64 bytes: opted-out, SIGHASH_DEFAULT +Input 1 witness: [nonce share || 0x03] # 33 bytes: half-agg member, SIGHASH_SINGLE +Input 2 witness: [] # empty: full-agg member +Input 3 witness: [] # empty: full-agg member +Input 4 witness: [nonce share || s || 0xbc] # 65 bytes: half-agg final +Input 5 witness: [64-byte sig || 0x82] # 65 bytes: opted-out, SIGHASH_NONE|SIGHASH_ANYONECANPAY +Input 6 witness: [64-byte sig || 0xbd] # 65 bytes: full-agg final + +This transaction has: +- Two opted-out inputs (0, 5) with different sighash types +- One half-aggregation group (inputs 1, 4) +- One full-aggregation group (inputs 2, 3, 6) + +Total overhead: 2 marker bytes +Signature size reduction: 450 bytes → 292 bytes + + +== Security == + +'''Non-consensual aggregation''': +The signature message of aggregated inputs commits to the aggregation mode, so third parties cannot move signatures between opted-out witnesses and aggregation groups, see [[#why-no-opt-out-marker|Why no opt-out marker]]. +Signatures also cannot be replayed between witness versions because the signature message always commits to the scriptPubKey of the output being spent. + +'''Adaptor signature incompatibility''': +Aggregation is incompatible with protocols that extract a secret from a specific signature appearing on chain, most notably some adaptor signature protocols. +Adaptor protocols in which the final signature is delivered directly between the parties are not affected. +Protocols that rely on on-chain extraction should use opted-out signatures for those inputs. + +'''Shared security of the three modes''': +Every witness v2 output can be spent through any of the three key path modes, chosen by whoever produces the witness. +The security of v2 outputs therefore rests on all three verification algorithms together, and a soundness failure in BIP 340, BIP 458, or BIP 459 would affect all v2 outputs regardless of the mode their owners intended to use. +Both aggregation schemes come with security proofs that reduce to established assumptions in the same discrete logarithm setting as BIP 340, see the security discussions in BIP 458 and BIP 459. + +'''Witness malleability''': +For key path spends every witness element size is fixed by consensus and the annex is committed by the signature message, so third parties cannot change the weight of a fully signed input. +Given the nonce shares of a group, only one value of ''s'' satisfies the verification equation, and replacing a nonce share requires knowledge of the individual signatures. +Third parties therefore cannot malleate witness v2 key path witness data. +Opted-out inputs carry plain BIP 340 signatures, which are non-malleable. + +'''Transaction level verification''': +Aggregated inputs add one transaction level verification step per aggregation group, while parsing, structure checks, opted-out inputs, and script path spends remain per-input operations. +Implementations that parallelize script validation per input can schedule the group verification as one additional check. +Existing wtxid based validation caches remain correct since any witness change alters the wtxid. +Aggregate verification can also join verification batches together with individual BIP 340 signatures, so aggregation does not preclude batch validation. + +'''Computation limits''': +Aggregation does not increase the worst-case signature verification cost of a block. +Full-aggregation requires about half the elliptic curve multiplications per input of individual BIP 340 verification, while half-aggregation requires about the same number in a single batchable equation. +The densest packing of signature verification work per weight unit remains tapscript under the BIP 342 validation weight budget, which this BIP does not change.A minimal Taproot key path input weighs 230 weight units, 164 for the input base data plus 66 for the witness element, and BIP 340 verification costs two elliptic curve multiplications per signature. +Per member of a large group, full-aggregation accounts for 166 weight units and half-aggregation for 198 weight units including the member's 32-byte nonce share, ignoring small per-group constants. +The BIP 459 verification equation costs ''n+1'' multiplications for a group of ''n'' inputs, while the BIP 458 equation costs about ''2n'' since the randomizers multiply both the nonce point and the challenge term of each member. +Ignoring transaction overhead, a block filled with minimal full-aggregation members needs about 4,000,000 / 166 ≈ 24,100 multiplications and one filled with minimal half-aggregation members about 2 * 4,000,000 / 198 ≈ 40,400, compared to 2 * 4,000,000 / 230 ≈ 34,800 for minimal Taproot key path spends. +The half-aggregation count is about 16 percent higher, but its per-input cost matches batch verified BIP 340 signatures and the whole group is verified as one multi-scalar multiplication, which is faster in practice than the same number of independent verifications. +All of these remain far below the BIP 342 validation weight budget, which admits one tapscript signature verification per 50 weight units, or 80,000 verifications with about 160,000 multiplications per block. +Aggregation also does not increase the maximum number of inputs per block, since an input spending an output that requires no signature, such as a bare OP_TRUE script, weighs only 164 weight units today. + +'''Mode fingerprinting''': +The aggregation mode of every input is visible on chain from its witness element, so distinctive mode combinations can fingerprint the wallets or protocols that created a transaction. +Participants of collaborative transactions should prefer one mode for all participating inputs if they want to avoid this. + +== Test vectors == + +Wallet operation vectors covering scriptPubKey and address computation, signature message computation, and witness construction for both key path and script path spending can be found in [[bip-0460/wallet-test-vectors.json|wallet-test-vectors.json]]. + +Transaction level validity cases, including marker parsing failures, group structure failures, annex handling, script path spending, and the aggregation mode commitment, can be found in [[bip-0460/consensus-test-vectors.json|consensus-test-vectors.json]]. + +Both files are generated by [[bip-0460/test-vectors.py|test-vectors.py]], which builds on the reference code of BIP 458 and BIP 459. +All vectors use deterministic test-only keys and nonces, and BIP 340 signatures are created with an all-zero auxiliary randomness array, except one vector that deterministically searches auxiliary randomness values to produce a signature ending in a marker byte. + +== Reference implementation == + +A work in progress implementation for Bitcoin Core is available at https://github.com/fjahr/bitcoin/tree/bip460. +It implements the validation rules of this BIP and validates all consensus test vectors. + +== Rationale == + +=== Why a new witness version? === + +A new witness version is necessary because BIP 341 completely specifies the validation rules for witness v1, fixing key path witnesses to 64-byte or 65-byte signatures. +The aggregation witness forms used by this BIP are invalid under those rules, and a soft fork can only turn valid transactions into invalid ones, not the reverse. +Aggregation therefore cannot be retrofitted onto existing Taproot outputs. + +=== Why the marker-based design? === + +The primary alternative to markers is a design without them, where aggregated inputs carry only a 1-byte sighash placeholder and aggregation applies to all witness v2 inputs of a transaction or to none of them. +Compared to that alternative the markers cost one byte per aggregation group. +In exchange the marker provides three properties: + +'''Per-input consent''': +An all-or-nothing design couples the choices of unrelated parties. +In a CoinJoin a single participant that requires a plain on-chain signature, for example for an adaptor signature based protocol, would force every other participant to forgo aggregation. +With markers this choice is local to the input, which matters most in exactly the multi-party transactions that CISA is designed to make cheaper. + +'''Self-describing witnesses''': +Every input is classified locally by the length and last byte of its witness element instead of inferring a transaction-wide mode from the shape of all witnesses. +This avoids inference edge cases. +For example, in the placeholder design the final aggregated input's witness consists of a sighash byte followed by the aggregate signature as a separate element, and an aggregate signature whose first byte happens to be 0x50 is misparsed as an annex under the BIP 341 annex rule. +Roughly one in 256 honestly generated aggregate signatures would hit this case and force the signers to start over. +In this design the signature data of every input is part of its single witness element, which the annex rule never inspects, so no signature data can be misparsed as an annex. + +'''Two coexisting groups''': +A transaction can contain one half-aggregation group and one full-aggregation group at the same time. +This allows a tightly coordinated subset of signers, for example the inputs of a single wallet, to use full-aggregation while the remaining inputs of a collaborative transaction use half-aggregation. + +Group members carry no marker, since the member element lengths are disjoint from all other forms and the length alone classifies them. +Half-aggregation members carry their nonce share directly instead of contributing to a growing aggregate signature on the final input. +This makes every witness element form fixed-size and distributes the witness weight of the aggregate evenly across the group's inputs. +Only the final inputs need a marker, because the completion of an aggregate signature is indistinguishable from a BIP 341 signature by content. + +A more flexible alternative with multiple aggregation groups per scheme, similar to the bucket concept from early aggregation discussions, was rejected. +Multiple groups would only benefit full-aggregation, since half-aggregation groups can be merged by anyone after signing. +They would allow several smaller signing sessions instead of one session spanning all aggregated inputs, for example through a group number encoded in the marker byte. +However, with SIGHASH_DEFAULT the signers of every group still have to agree on the complete output list of the transaction before signing, making coordination across groups necessary. +Decoupling the groups through SIGHASH_SINGLE with SIGHASH_ANYONECANPAY is limited to groups of signers with a single input and output each, reveals which input pays which output, and lets anyone split the merged transaction apart again. +Half-aggregation already provides this flexibility without any joint signing session at a cost of 32 weight units per input, and a separate transaction per group provides it at the cost of repeating the transaction overhead. +Group numbers would also reveal which inputs belong together, which has negative privacy implications. + +=== Why no opt-out marker? === + +The main motivation for the unmarked opt-out is compatibility with BIP 341. +Opted-out spends are byte-identical to BIP 341 key path spends, so wallets that do not aggregate can adopt the new output type without new signing logic. +Leaving out the marker also saves one byte per opted-out input. + +Opted-out inputs still need protection from non-consensual aggregation. +Half-aggregation of existing signatures is a public operation. +Any third party in possession of valid BIP 340 signatures, such as a miner or a relaying node, can aggregate them without the signers' involvement. +Some protocols depend on a specific signature appearing on chain. +Most notably, some adaptor signature protocols extract a secret from the difference between an on-chain signature and a previously shared adaptor signature, and this extraction becomes impossible once the signature has been folded into an aggregate. + +For this protection the separation of the signature messages is sufficient. +An opted-out signature is created over the BIP 341 message and is therefore useless as an aggregation group member, and vice versa. +Aggregation is consensual for every input. + +An explicit opt-out marker would serve parsing rather than protection, distinguishing a 65-byte opted-out signature with a sighash byte from an aggregation group final without one. +Markers in the position of the sighash byte resolve this ambiguity without marking opted-out inputs, since marker values are disjoint from valid sighash values. +A small caveat is that a future witness version that keeps the witness v2 rules cannot use the marker values as sighash types. + +A consequence of the mode commitment is that the aggregation mode is chosen at signing time. +A signature created for aggregation cannot later be used as a standalone opted-out signature either, so signers that want to keep both options open must produce two signatures. +Planning for aggregation costs one weight unit if the group ends up with a single member, since the single-member group signature carries the marker. + +=== Why two aggregation schemes? === + +Half-aggregation and full-aggregation serve different use cases: + +{| class="wikitable" +|+ Comparison of aggregation schemes +|- +! Property !! Half-Aggregation !! Full-Aggregation +|- +| '''Signature size''' || ''(n+1)*32'' bytes || 64 bytes (constant) +|- +| '''Interactivity''' || Non-interactive || Interactive (2 rounds) +|- +| '''Use case''' || All transaction types || Interactive protocols such as CoinJoins, wallet consolidation +|- +| '''Incremental''' || Yes || No +|} + +Full-aggregation offers roughly twice the savings of half-aggregation but requires all signers to run a stateful two-round protocol within one signing session. +Mishandling the secret nonce state between the rounds can lead to key extraction, which makes supporting it on hardware signers and air-gapped devices demanding. +The slow adoption of MuSig2 by signing devices illustrates this cost. + +Half-aggregation signers produce plain BIP 340 signatures in a single stateless pass, and the aggregation happens downstream of all signing. +This fits existing asynchronous multi-party workflows, for example PSBT based signing ceremonies where cosigners are available at different times, or [[bip-0077.md|BIP 77]] Async Payjoin where sender and receiver are not required to be online at the same time. +It also avoids giving every participant of a large collaborative transaction a second opportunity to stall the protocol between signing rounds. +Finally, half-aggregation composes with workflows where the input set is still growing after signing has started, such as ANYONECANPAY based fee bumping, because aggregation can happen once the set is final. + +=== Why key path only? === + +Key path spends have one signature per input that is visible from the witness structure alone, which makes their aggregation rules simple. +The use cases motivating this BIP, collaborative transactions and consolidations, also typically use simple key path spends. +Aggregating signatures from within scripts, in contrast, conflicts with the tapscript upgrade mechanisms. +Whether a signature operation contributes to the transaction level aggregate depends on script execution, but a script containing an OP_SUCCESS opcode succeeds without being executed. +A later soft fork redefining such an opcode would change which signatures the aggregate has to cover, so transactions valid under the new rules would be invalid for older nodes, turning the redefinition into a hard fork. +This is a variant of the problem described in [https://gnusha.org/pi/bitcoindev/20180321040618.GA4494@erisian.com.au/ the 2018 aggregation discussion by Anthony Towns], whose mitigations rely on execution order, which the parse time OP_SUCCESS semantics of tapscript do not provide. +Script execution raises further design questions, for example the BIP 342 sigops budget assumes 50 witness weight units per signature check and would be exhausted by short placeholder signatures, and the aggregate signature must be located before execution while group membership only becomes known during it. +Solving these questions is left for a separate BIP with its own upgrade semantics. + +=== Usage of ANYONECANPAY === + +This BIP permits all standard sighash types at the consensus level, including SIGHASH_ANYONECANPAY (0x80 flag). +Whether to aggregate is an application level decision, not a consensus concern, so the consensus rules stay permissive. + +'''Full-aggregation''': +The signing session of BIP 459 fixes the group's public key and message lists, so the membership of a full-aggregation group cannot grow after signing has started. +ANYONECANPAY still composes with full-aggregation in one direction. +Once the group members have signed with ANYONECANPAY, additional opted-out, half-aggregated, or non-v2 inputs can be appended to the transaction without invalidating the group, because the group's messages do not commit to those inputs. +Only extending the full-aggregation group itself with later inputs is impossible. + +'''Half-aggregation''': +Half-aggregation composes with ANYONECANPAY directly. +Signers create their signatures over the half-aggregation flavored message at signing time, further inputs are added later, and once the input set is final anyone can aggregate the collected signatures without further involvement of the signers. + +=== Future considerations === + +'''Block-wide aggregation''': +Block-wide aggregation remains a potential future optimization and is not precluded by this design. +Opted-out inputs do not necessarily signal that the signer needs the signature on chain unaggregated, since there may be other motivations such as simple adoption, so such a design would probably need its own explicit opt-out. + +'''Script path aggregation''': +Script path aggregation can be specified in a separate BIP and added in the same or a future soft fork. + +== Deployment == + +This BIP is to be deployed by a soft fork activation mechanism. +The activation parameters are to be determined and will be specified in a future update of this document. +Since other proposals also target witness version 2, the witness version is subject to coordination and may change in a future update as well. + +== Backward compatibility == + +=== Non-upgraded nodes === + +Nodes that have not upgraded to support witness v2 treat witness v2 outputs as anyone-can-spend, per the [[bip-0141.mediawiki|BIP 141]] unknown witness version rule. +Depending on their policy settings, such nodes might not relay witness v2 transactions or include them in blocks. + +=== Non-upgraded wallets === + +Wallets without witness v2 support cannot create or spend witness v2 outputs but can send to witness v2 addresses if they support Bech32m. + +== Acknowledgements == + +Thanks to Vojtěch Strnad for feedback on early versions of this BIP, in particular for prompting a precise description of the script path aggregation obstacles and for streamlining the specification. +Thanks to conduition for suggesting the distribution of the half-aggregation signature data across the group's witness elements. + +== Footnotes == + + diff --git a/bip-0460/consensus-test-vectors.json b/bip-0460/consensus-test-vectors.json new file mode 100644 index 00000000..7330316d --- /dev/null +++ b/bip-0460/consensus-test-vectors.json @@ -0,0 +1,1014 @@ +{ + "testCases": [ + { + "id": "halfagg-valid", + "description": "Two-member half-aggregation group, SIGHASH_ALL", + "prevouts": [ + { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "amountSats": 100000000 + } + ], + "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b0121571098a90a1077c7552282afd69f9cd0fa43a1de634b15761cbc10118ba51aee010142d3be7917478689bc10fec632019ff3c203d26df874171a8b934aa2e563ee98f1e2e326fc752b9402b509e3067a17b320c9c7687af7515eaa7fd3db60b8cc7f2601bc00000000", + "valid": true + }, + { + "id": "fullagg-valid", + "description": "Two-member full-aggregation group, SIGHASH_ALL", + "prevouts": [ + { + "scriptPubKey": "52208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e4", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522018b6491469cc78b764b01669b0a5a4e892f57e8c1b20b89bc1ca6dce3e881b51", + "amountSats": 100000000 + } + ], + "tx": "0200000000010254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0000000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0000000000ffffffff01c07fdc0b000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e401010101424bce4f189f7e82eca1ebd747e8fb4199741522d94f6bccf62faa6a9bf5bc98092c7970476fa0c6d516c72b77fa772edd04cdbac879a42a6cf45f043720a07b7901bd00000000", + "valid": true + }, + { + "id": "mixed-valid", + "description": "Opted-out input alongside a two-member half-aggregation group", + "prevouts": [ + { + "scriptPubKey": "5220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220d0d1709a7b6eef6e5309f9115b163b0a72295b837923a5251641352e5d6ae21f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52206bcb2a825ab91fa41da5f6cc1b51edf07ce6dc769e497d741c39ee4de7eb0966", + "amountSats": 100000000 + } + ], + "tx": "0200000000010305a375e47ab8044473e9642b89e8d0e23c39e6dff3ebc3decd3a21e36df5c8f10000000000ffffffffa098dbe94bda678231b9b104eadb0afd61f44a955146c5518b039ffbdc54eee60000000000fffffffff861074487871c360c0a79a8a0520e6efea15cb031a2b249d5342c417a18d4710000000000ffffffff01c060d21100000000225220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce0140a27155234a9a9c718d3cf638f5caadcbf7d476d7a595aafc40059103773eac36aa44f9b62153b3322329e14d345bb8e5cbc654fcba2a55cda471aaa2f1524fcf0120b7f385ee1e8cee81cc4f5dd06cfa4471807f48aa61d6791c8d0851459a15cea501411587da1c10801778e65bb13619388ec6973f05fbb00c1ab88b1d51e5e60d5dc17b53fabdf09dab1b636008551933346a2a4ada059c8294640dc950bcc6e58213bc00000000", + "valid": true + }, + { + "id": "optout-sighash-undefined", + "description": "65-byte opted-out signature ending in the undefined sighash value 0xbb", + "prevouts": [ + { + "scriptPubKey": "5220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220d0d1709a7b6eef6e5309f9115b163b0a72295b837923a5251641352e5d6ae21f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52206bcb2a825ab91fa41da5f6cc1b51edf07ce6dc769e497d741c39ee4de7eb0966", + "amountSats": 100000000 + } + ], + "tx": "0200000000010305a375e47ab8044473e9642b89e8d0e23c39e6dff3ebc3decd3a21e36df5c8f10000000000ffffffffa098dbe94bda678231b9b104eadb0afd61f44a955146c5518b039ffbdc54eee60000000000fffffffff861074487871c360c0a79a8a0520e6efea15cb031a2b249d5342c417a18d4710000000000ffffffff01c060d21100000000225220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce0141dedf1756248eea012d69b0f9a06dcd6028434e5922725eb16b94a0e6cd5a8480e4b97a538925824325985f90b94292d797733ac8952644819d411b705d35b1afbb0120b7f385ee1e8cee81cc4f5dd06cfa4471807f48aa61d6791c8d0851459a15cea501411587da1c10801778e65bb13619388ec6973f05fbb00c1ab88b1d51e5e60d5dc17b53fabdf09dab1b636008551933346a2a4ada059c8294640dc950bcc6e58213bc00000000", + "valid": false, + "failureReason": "undefined sighash type" + }, + { + "id": "member-explicit-default", + "description": "Half-aggregation member encodes SIGHASH_DEFAULT explicitly as a 0x00 sighash byte", + "prevouts": [ + { + "scriptPubKey": "5220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220d0d1709a7b6eef6e5309f9115b163b0a72295b837923a5251641352e5d6ae21f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52206bcb2a825ab91fa41da5f6cc1b51edf07ce6dc769e497d741c39ee4de7eb0966", + "amountSats": 100000000 + } + ], + "tx": "0200000000010305a375e47ab8044473e9642b89e8d0e23c39e6dff3ebc3decd3a21e36df5c8f10000000000ffffffffa098dbe94bda678231b9b104eadb0afd61f44a955146c5518b039ffbdc54eee60000000000fffffffff861074487871c360c0a79a8a0520e6efea15cb031a2b249d5342c417a18d4710000000000ffffffff01c060d21100000000225220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce0140a27155234a9a9c718d3cf638f5caadcbf7d476d7a595aafc40059103773eac36aa44f9b62153b3322329e14d345bb8e5cbc654fcba2a55cda471aaa2f1524fcf0121b7f385ee1e8cee81cc4f5dd06cfa4471807f48aa61d6791c8d0851459a15cea50001411587da1c10801778e65bb13619388ec6973f05fbb00c1ab88b1d51e5e60d5dc17b53fabdf09dab1b636008551933346a2a4ada059c8294640dc950bcc6e58213bc00000000", + "valid": false, + "failureReason": "explicit 0x00 sighash byte" + }, + { + "id": "group-no-final", + "description": "Half-aggregation members without an input carrying the marker and the s value", + "prevouts": [ + { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "amountSats": 100000000 + } + ], + "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b0120571098a90a1077c7552282afd69f9cd0fa43a1de634b15761cbc10118ba51aee0120d3be7917478689bc10fec632019ff3c203d26df874171a8b934aa2e563ee98f100000000", + "valid": false, + "failureReason": "aggregation group has no final input" + }, + { + "id": "member-after-final", + "description": "Half-aggregation member appears after the group's final input", + "prevouts": [ + { + "scriptPubKey": "5220f4746153737986ea947e2d197427a62d01f251630de2be1c575124f0d932366b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52200a9deddd6e095811ffe5c061dbee3ba0c57d107d73ae1f5bd04ffaf851495e95", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52202c8ed1bfdfdedf23b4a63a374a5a4b3c7575403f93c7bddb10be5011a2c6a471", + "amountSats": 100000000 + } + ], + "tx": "0200000000010392ccaa54e5e62f3bd670417a6b572c92cccc3da6bc1cc66df5e503d40112a44f0000000000ffffffff5928ed52c21e87265486ae544e6415b381ee2914638c962c864564c5e0302a770000000000fffffffff0687ec7cc1986f69faeccca2bc20fec6290472ea48f384c8b830c656e4a3d6d0000000000ffffffff01c060d21100000000225220f4746153737986ea947e2d197427a62d01f251630de2be1c575124f0d932366b01200904e70d45681dd516e58aaf575e78f86c9cff6694a126b8de04aac5c919d16e01418676a78d02e381009db0547e06c6c7113fefa4dd1f00128ce38a83e9a3af77a8add351a099eb3fffc3aad5ac4d7c19ad545696b6c5c05bf9c308d02f0de96c87bc01208676a78d02e381009db0547e06c6c7113fefa4dd1f00128ce38a83e9a3af77a800000000", + "valid": false, + "failureReason": "member after group final" + }, + { + "id": "element-length-undefined", + "description": "2-byte witness element ending in a marker byte, matching no defined structure", + "prevouts": [ + { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "amountSats": 100000000 + } + ], + "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b010201bc0140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000", + "valid": false, + "failureReason": "marker and length match no defined structure" + }, + { + "id": "cross-mode-fold", + "description": "Opted-out signatures folded into a half-aggregation group by a third party", + "prevouts": [ + { + "scriptPubKey": "5220ca8344e759bfb6492d1ea6cfaafac886df066bc099ac3455632b2d3680dea261", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220c1253f68ccd5faf5e3dfa399bb499092ecd39384be321aee8ac476b0773569c8", + "amountSats": 100000000 + } + ], + "tx": "02000000000102c0f4bc942ecfa2798ebbcc06bcbda200152e1d99c434d93c3f3b769e292a7fb10000000000ffffffff109ee50850f7dc5b6b5ece311830798e23b94f633f6afb62043d768fac7d24910000000000ffffffff01c07fdc0b00000000225220ca8344e759bfb6492d1ea6cfaafac886df066bc099ac3455632b2d3680dea261012095c0f5df0ba95b4b0d215407e79942b73e65eb6361a9a306035050ddbf5a807c01413626190b6b57950d8b24cd4c087efcf4893dc6a04d2e18d7db1bf0be74dfb92cba46abfc8dc2c8ee14c0b785afbde0301be1de190129f14371e72b737ee94e8fbc00000000", + "valid": false, + "failureReason": "aggregate signature invalid, messages commit to the aggregation mode" + }, + { + "id": "empty-witness", + "description": "Witness v2 input with an empty witness", + "prevouts": [ + { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "amountSats": 100000000 + } + ], + "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b000140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000", + "valid": false, + "failureReason": "empty witness" + }, + { + "id": "optout-explicit-default", + "description": "Opted-out input encodes SIGHASH_DEFAULT explicitly as a 0x00 sighash byte", + "prevouts": [ + { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "amountSats": 100000000 + } + ], + "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b0141a63e68a4f5ea6f759dc5bd22fbd8bb49001b72db053e3ae2fe2e352f905e92c960c47b7753174838713fa2ba7127e21c34493d416636376d94011f1eba75804f000140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000", + "valid": false, + "failureReason": "explicit 0x00 sighash byte" + }, + { + "id": "optout-sig-ends-in-marker", + "description": "Opted-out 64-byte signature whose last byte equals the half-aggregation marker 0xbc", + "prevouts": [ + { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "amountSats": 100000000 + } + ], + "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b014028efc4abb49aa3f2e279dacf06add426b4c07794d98b872e864a2c5523aa0fa6ba1f7b9c77190d6206b6027f6dfb16bb0615ada00cbf51f9b2d0441f47d715bc0140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000", + "valid": true + }, + { + "id": "annex-committed-valid", + "description": "Half-aggregation group whose first member carries an annex that is committed in its signature message", + "prevouts": [ + { + "scriptPubKey": "5220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220af9693bcd26365ebb9fea91dfbfacf2b96a2e3c06dc2a16f706a15d8ee3a4cc5", + "amountSats": 100000000 + } + ], + "tx": "020000000001022b72230eed37d5af4f7400a9eb61103cbbf1f9a4dd3b85e7231186ef9fa51fa80000000000ffffffffccadb04d02ec2ae661263fe6801aacf882ed7a01c6ac6aa2cce40f2b9ca16f780000000000ffffffff01c07fdc0b00000000225220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c02201d353f924fcde6d6f4a390c831b77ba5b8c54359a1d26c902e7f6d9ec670d6c310504349534120616e6e6578207465737401411cbc8db7b701dd35e61873370a2b0d32d42ffe3a223b448a0d39253dc93576757a70d81e6373ce859478226e7cd932892f23ef6cfbf2a9f8a597ef0b450a010fbc00000000", + "valid": true + }, + { + "id": "annex-stripped", + "description": "Annex removed by a third party from the transaction of annex-committed-valid", + "prevouts": [ + { + "scriptPubKey": "5220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220af9693bcd26365ebb9fea91dfbfacf2b96a2e3c06dc2a16f706a15d8ee3a4cc5", + "amountSats": 100000000 + } + ], + "tx": "020000000001022b72230eed37d5af4f7400a9eb61103cbbf1f9a4dd3b85e7231186ef9fa51fa80000000000ffffffffccadb04d02ec2ae661263fe6801aacf882ed7a01c6ac6aa2cce40f2b9ca16f780000000000ffffffff01c07fdc0b00000000225220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c01201d353f924fcde6d6f4a390c831b77ba5b8c54359a1d26c902e7f6d9ec670d6c301411cbc8db7b701dd35e61873370a2b0d32d42ffe3a223b448a0d39253dc93576757a70d81e6373ce859478226e7cd932892f23ef6cfbf2a9f8a597ef0b450a010fbc00000000", + "valid": false, + "failureReason": "signature message committed to the annex" + }, + { + "id": "scriptpath-valid", + "description": "Witness v2 script path spend of a single CHECKSIG leaf under BIP 341/342 rules, alongside an opted-out key path input", + "prevouts": [ + { + "scriptPubKey": "5220e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522044fdf832ec12334a9c3316767eae801d4cc9fa26723267e58107cc4574e3b64d", + "amountSats": 100000000 + } + ], + "tx": "020000000001027ce7215887dea171a102c5f9c3b5a9835ee098a1fe51a8e6f6bddedd0b173f400000000000ffffffff992524364c91d1d04d24dbf8ea0444e5d2ac69944c0f84ac48d0756abf1bfa1a0000000000ffffffff01c07fdc0b0000000022522084dba7b2063ea2384cada9c8a3b014659c51c9f79ab4e5a40fee826fd9a167790340d49a402de13f7d71177322ff53b56d0e6210e9aa9d902b4a91db9ab1892bc7ef7363cd73d75c09034dec2aa7e2044bc877b16e81e1ff3aa40282420559340aaf222038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac21c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da40140e3c17568cbb14e170c60de5a2fbe0312d89a952ee8e42c8c51da647eafdddddd95bd482b3313c1dcca48463a40df23559361b0ae33d15ecdd8dd3065e8a51a3200000000", + "valid": true + }, + { + "id": "cross-mode-fullagg", + "description": "Full-aggregation signature created over plain BIP 341 messages, placed in a full-aggregation group", + "prevouts": [ + { + "scriptPubKey": "5220d8ce2162ebd4a65d21981113193e470a7605970928b5fcfe9636d0a2d4cecc4f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cd51647dde7739fd367ab5666c6b6b32ce728a456ca59621df488418abba93c6", + "amountSats": 100000000 + } + ], + "tx": "0200000000010277580c79efee3a3be2056167eb3c5785e480b1bb86255389d32709d071d75fe80000000000ffffffff934ab77ec846c517e4f710c23f2b1cb8c6df84754287bea2c52cb2876260b33f0000000000ffffffff01c07fdc0b00000000225220d8ce2162ebd4a65d21981113193e470a7605970928b5fcfe9636d0a2d4cecc4f010001410d2d7ec50a77afb574d7f11177a47d60e8f53dbbb5a1eb598d0dc49d0609efba692a8e413a324979073f579a8fe858017664b824929505b21bdac238e3b5eef4bd00000000", + "valid": false, + "failureReason": "aggregate signature invalid, messages commit to the aggregation mode" + }, + { + "id": "fullagg-size-mismatch", + "description": "Full-aggregation final input carries 96 bytes before the marker (97-byte 0xbd element, matches no defined witness structure)", + "prevouts": [ + { + "scriptPubKey": "52208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e4", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522018b6491469cc78b764b01669b0a5a4e892f57e8c1b20b89bc1ca6dce3e881b51", + "amountSats": 100000000 + } + ], + "tx": "0200000000010254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0000000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0000000000ffffffff01c07fdc0b000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e401010101614bce4f189f7e82eca1ebd747e8fb4199741522d94f6bccf62faa6a9bf5bc98092c7970476fa0c6d516c72b77fa772edd04cdbac879a42a6cf45f043720a07b790000000000000000000000000000000000000000000000000000000000000000bd00000000", + "valid": false, + "failureReason": "marker and length match no defined structure" + }, + { + "id": "two-groups-valid", + "description": "Mixed transaction mirroring Example 4 of the BIP: two opted-out inputs, a half-aggregation group with a SIGHASH_SINGLE member, and a full-aggregation group, with interleaved input indices", + "prevouts": [ + { + "scriptPubKey": "5220b3fd2ebe2399bee6b51828e7fcb82ae1752516c6866c058516a8d592f38b19e8", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52209123086f2d8d878088ec611185f841658513af7f29a1359685eda09536d7dc5d", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52201ce55104c3bd91d20b8d7702d4157bb5a70bc0b6e63cd73c3e7684b9c3156d70", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522049875458881f78c4ed3d5fb0e95ee527a2dce487ebad7cc92bdf28a9017df888", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220fbfa11a63ffeff576f5d408c5618ed8761aeb5b6dc92ab36055b792c3cd8ceea", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52207ae16cb88e80051ca988443009fde24fe4d6638f5870fa5cdc6689755bfa24a3", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220ad8f2c1d50a83478441fb5b5887dc53dcf5f342d63a4a1b0e848aef31f2d25b1", + "amountSats": 100000000 + } + ], + "tx": "020000000001074dd302fda269f70608bc946098680dbfee25271c19d636ccc42076049f66d3850000000000ffffffff2b5f4f73da1e6ae2f7dbeddf95ceee3219ce7f4a14780bb957453015ad21c9840000000000ffffffffa43d649606b2b1ba5690d9e796f73f4ac8a4621594a29feb75f7313be68c2a2c0000000000ffffffff89bcd4114dfed0f70ab200fbcbad208d2a17cb23f4d582d34c280cb23ef00db20000000000ffffffff92fc75b30a6e897056ed31a32ea0785e9130fd04a2cdf38f8e8a80c9015c65d90000000000ffffffffba7b09c4178344c89056482bbb515c7dd45bccd7de7d6c9b766ee151490b63ff0000000000ffffffff10d992fa14c1f6bb3d82f31b9e8315cb0dd1caf5f631d9ce1c84f6d8762ebbb40000000000ffffffff028093dc1400000000225220b3fd2ebe2399bee6b51828e7fcb82ae1752516c6866c058516a8d592f38b19e84051cd14000000002252209123086f2d8d878088ec611185f841658513af7f29a1359685eda09536d7dc5d0140f06432774c5ec95fd300d85765721bcbbedc4b65c4aa2984eaa99db92d7547c7a20346fde48e7c769e0d18ff908cdb20e67637671e5b5130cf86e7612348e0c80121495cbe82aa8b5c134aaa6e482294108232706b1b9bc17ec6dd2a142921a27c3203010001000141ca82d465c5b280bc90d0724e3193d84a36df9761df5927ef7317b1109b692e1a974d0e1d0b807b6b52973ef5b9d0635a7bc8acdfef502068d0d9d4f78e774681bc0141b7f82c5f2d47916937286df6ca545e18a1250d6abec3a8b3636c2c8a7c53a565d8cee64cf0675d85f59020b6da547f694f6b981b1d51f6a1248716777f8b51be8201416efcc2fd173c5952fa7da7170f0eaaea7afff3454754f84f326e54ff905828e5a4b83305b72cdde0995d6cd4df4a2b5cf3508242cf821de0caf462ed1a1a3b3abd00000000", + "valid": true + }, + { + "id": "sighash-single-no-output", + "description": "Opted-out input uses SIGHASH_SINGLE at input index 1 of a single-output transaction", + "prevouts": [ + { + "scriptPubKey": "5220f082518f206f3be02e70d0b1eabd7152c6e4e3cd8c7df5517f198a049e1b5520", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52207cef82518a7ac1c239b1e33a92197ea618f06ba71be021f59a73bb1f39d2acf2", + "amountSats": 100000000 + } + ], + "tx": "0200000000010242df0f438abfad5a59cfa19d12c0a7954b04301830c63049f741c0ed73e591f00000000000ffffffffb354dc5ffad02a76b72e6d702aecd38161d43bc42c1de51dc4a62c5bcb4fe6ae0000000000ffffffff01c07fdc0b00000000225220f082518f206f3be02e70d0b1eabd7152c6e4e3cd8c7df5517f198a049e1b552001406308a21865e2cade24f94bc880f77a123cb791f88eedf9a49b63c01abf9e40347b8cbfd2fd230fbcea9be51ea1f8f0dd604e1ea847ed92c98fb3c13304c72efd0141fccbf16c8d49d14eb7b40bc9bf57a7ca416379a7f55d2693f4cac6895eaa9aba133876a6d20a5bd5ee2d37da3f3dd79119e00a0f0eea6509723f6ec08107acad0300000000", + "valid": false, + "failureReason": "SIGHASH_SINGLE input without corresponding output" + }, + { + "id": "halfagg-two-finals", + "description": "Two inputs each carrying a 65-byte half-aggregation final element", + "prevouts": [ + { + "scriptPubKey": "5220ba77666df5eb8e5c526acedd38d36fc5eaa66da3e26460b71fb7b164089aeb1d", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220379fd1c1e12519df482f6c99b464892f04f59418b20b5f65105a93e240e99013", + "amountSats": 100000000 + } + ], + "tx": "020000000001025cb6b3fb7d3453d43f571a65d462f30f76bcf4a9cfe6bbd13b59ce601b8475cb0000000000ffffffff57b6ff1c4d459776ed587d8242d7d41c913c64b264eb1f72145489b677fadf4f0000000000ffffffff01c07fdc0b00000000225220ba77666df5eb8e5c526acedd38d36fc5eaa66da3e26460b71fb7b164089aeb1d01417607930ce963eb16ef197fafd0d91dc4ddae836d56745e49713f4d10d0a801e730acc481cbcc2797ddeebb575808191501821c634b2e9f628427d30e0a2876f5bc01415866fbabc10dd40c01e0945b2e414ba9bc509f36275ef21738483dda50a3f6019c35b81f37fbc4c98be423dc9f782ae71f835f5870495ae31519a8147c4b1b46bc00000000", + "valid": false, + "failureReason": "more than one final input in a group" + }, + { + "id": "fullagg-two-finals", + "description": "Two inputs each carrying a 65-byte full-aggregation final element", + "prevouts": [ + { + "scriptPubKey": "5220a0bb2d2ca5161c1c7bf13ba18767027e3c68e24a23e8fffce66f590c7990f2c1", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522080fa96d74b89de3ae09becd3ab08a1f337471ec9a0104ef6571bdc24737826ba", + "amountSats": 100000000 + } + ], + "tx": "02000000000102faf294804fe43f7dfec177b001477ea5227e47cfa71dc1e4aa60a84d94af0d0e0000000000ffffffff0056c298771ca89f13e7ce4d0b03a282f4803a332d6cf73050ed20cc4bf113b30000000000ffffffff01c07fdc0b00000000225220a0bb2d2ca5161c1c7bf13ba18767027e3c68e24a23e8fffce66f590c7990f2c101411b64cfc02599a4e76f31a16d29267089a4c050ae79565a65c0ff9ebe957c94ffdc46bfbdd07ff72ee3acfe94d943cdd9a0e8d83b757fd4a11abe17556a88fe39bd0141d2b090eab44e95dd388fe5fc98bb974fd83648cbd915c99736fe86c5a3a08efecaf04851dd56e1d664e4db4dbf8e11044946f1c2add16dc6d0b0ed45aaaf3c5bbd00000000", + "valid": false, + "failureReason": "more than one final input in a group" + }, + { + "id": "fullagg-no-final", + "description": "Full-aggregation members without an input carrying the marker and the aggregate signature", + "prevouts": [ + { + "scriptPubKey": "522014ef07b53514ff8cd94d4e6f4ae0fe246bed37e20c365679f404be89a84a941f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220ce9d369fb59e92098b3e0389cb8d91a3e0807fe51b04dfb7f77a50312498bb02", + "amountSats": 100000000 + } + ], + "tx": "02000000000102027c0bbee08a5b2b927eac3b88b8305a951fa546550f67a6c52b5542bab2f8ce0000000000ffffffffda74bc8dc984d4dcf61700d4e246a2b781c65d3583e4a99760ef88747fad4bf20000000000ffffffff01c07fdc0b0000000022522014ef07b53514ff8cd94d4e6f4ae0fe246bed37e20c365679f404be89a84a941f0100010000000000", + "valid": false, + "failureReason": "aggregation group has no final input" + }, + { + "id": "fullagg-member-after-final", + "description": "Full-aggregation member appears after the group's final input", + "prevouts": [ + { + "scriptPubKey": "5220f94afc4ad57d30e591c8c2e36c9f4436a4583a110048f909759dcc4afd1eca0a", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220029fb6b380929cdc76037e241819adbc7a27a14335a855d087bbe2e957a62110", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220130647b26b8fa4baf6e7974cc280be301ae0a186b5b43b36f8fb12b680281eec", + "amountSats": 100000000 + } + ], + "tx": "0200000000010325af39ed72d725fdc2edcbfbeca5f24ace00352010e3e10de0d0792b6ed6d9500000000000ffffffff6e55f5fe52f5b4d3f707a20ac5cf6280acfca6b29bfd17c2249eac2b5799d2e70000000000ffffffff5875cf9e3bd9c121e935691bdc84c18daf7f3a9f697a525e59330829282857f90000000000ffffffff01c060d21100000000225220f94afc4ad57d30e591c8c2e36c9f4436a4583a110048f909759dcc4afd1eca0a01000141dbdac6879a53e194ed0fcc44df68a971f426186d06473488874b6b1761f0f19de74588d7784166ff63aa59f3717505d4da01066f2d1e22c81665fd374ce71bfbbd010000000000", + "valid": false, + "failureReason": "member after group final" + }, + { + "id": "halfagg-single-member", + "description": "Half-aggregation group with a single member carrying a 64-byte aggregate in a 65-byte element", + "prevouts": [ + { + "scriptPubKey": "5220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c6", + "amountSats": 100000000 + } + ], + "tx": "0200000000010187fea558630296d581abd8d24b147faeaa371a0d325edcf565b6719d8fd5ea310000000000ffffffff01c09ee60500000000225220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c60141bf6915975cc9bf5ab48830c0f34026519f668d453624848298d9e17fbf1362792f96def59bbab5ae47ab790704392b1e456703ad14bf72c375e874fff750dd1abc00000000", + "valid": true + }, + { + "id": "fullagg-single-member", + "description": "Full-aggregation group with a single member", + "prevouts": [ + { + "scriptPubKey": "522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b", + "amountSats": 100000000 + } + ], + "tx": "02000000000101787d107a893487240e835409c4cd5c68420bd6301ee936c2b201e90ad5bc8de60000000000ffffffff01c09ee6050000000022522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b0141918fef8d8d2d4312ea43c7aa3fa34f0827387318fe81fb1ad63b18d1f1e14c84e9bba54f4f81cb9d7bee3fcd0823a80af0c6608f54b83e935df1a632e2e03675bd00000000", + "valid": true + }, + { + "id": "annex-lookalike", + "description": "Single witness element starting with the annex prefix 0x50", + "prevouts": [ + { + "scriptPubKey": "5220c0354bcb3c4b096849967c23f7f424baa649b15777a1ed25d52770064a84be10", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522000277756e6ec3da81b4854d52ecac45717fc3c5cc3b27ddcf6e3755b41fd87c9", + "amountSats": 100000000 + } + ], + "tx": "02000000000102948f52623998b05a3ba6679673c6894c7b9a596869421be46b54c7db521a7a8d0000000000ffffffff31509114c2c60b92f3e6037bf52ad75bac26572a19178051fd1ee1e7ae08ead30000000000ffffffff01c07fdc0b00000000225220c0354bcb3c4b096849967c23f7f424baa649b15777a1ed25d52770064a84be100110504349534120616e6e65782074657374014019550ec646820ed9cda8f5c16bd3cae2f03338bf1115a540e2397a93436d88adf5fdd08e4deee93389d6bf9ee32425a4c0b17af78b83df55a62f42ff7cb3eb0a00000000", + "valid": false, + "failureReason": "matches no defined structure, a single element is never an annex" + }, + { + "id": "annex-on-final", + "description": "Half-aggregation group whose final input carries an annex that is committed in its signature message", + "prevouts": [ + { + "scriptPubKey": "52207dfc09f1e03f0d901bc2410833199965cb2a884891ad9889ff5352b29abb2922", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220f9744be4cd3ce7a2fd0b6a453f94e758db9b4abc47825460cfe48d41100f10e4", + "amountSats": 100000000 + } + ], + "tx": "02000000000102395d48eb0b3ef75dd62014fffcff868fdea29bb830b9fe14e11ae84b22e0bc6d0000000000ffffffffeb44386a3268ac6fb39f78bc9d7023176bd027ff6d7cff7007facf4b98455b840000000000ffffffff01c07fdc0b000000002252207dfc09f1e03f0d901bc2410833199965cb2a884891ad9889ff5352b29abb29220120a6be4df7499feb83100032270c47f4e5e6170c46de0613bd7b75b94774505a960241076f82a2e92e4b6d2810850b5d8e645ea91fea52e6464873d22ad66e80cc9dfc2f916cba05be88bafa374a9a1db5451eeb0780365a6505986ab81af0bf038254bc10504349534120616e6e6578207465737400000000", + "valid": true + }, + { + "id": "sighash-value-undefined", + "description": "Opted-out input with the undefined sighash value 0x04", + "prevouts": [ + { + "scriptPubKey": "52207eab9a8cd328cf1ed6329998569ec6b195c368c02cf5c6108476fe95426d883e", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522002d94ebbd12c91590497f89072b4c5b52a77f09f4f1e6f7da33ccccda240f6f7", + "amountSats": 100000000 + } + ], + "tx": "020000000001029e94c92941217af1eae64bcfa170116a85cf01c1b0a68d61f4f12bdd09bfdbdc0000000000ffffffff0109ff9ad5f993dec28e407eced18a14380ef4f1d2fb5951f46e8a3506b605b50000000000ffffffff01c07fdc0b000000002252207eab9a8cd328cf1ed6329998569ec6b195c368c02cf5c6108476fe95426d883e014142492792bf2d96ce1ac7a0c2b874a2f36180e1f1275520627b68a578a6929823ce0f5179c57f8cc9487c608ac4d63acc2f5426e151b134ca0e05b15c26711da404014042034bf35d7f3faa9e96da927521ddc3cfa98bb4e7f645cad49a79a9eb2fe07546c0531e1f311957917899e8f1b1bcfdead805e101390c5b8ea83ff71c35c3a200000000", + "valid": false, + "failureReason": "undefined sighash type" + }, + { + "id": "member-sighash-is-marker", + "description": "33-byte element ending in the marker 0xbc, a half-aggregation member with an invalid sighash byte", + "prevouts": [ + { + "scriptPubKey": "5220525bedf0f14fdace49ed96c64c32603f79890443a3e97de56195e56c69b12820", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522052448ca22a975f6526b124857f9cc09aab766848bc29fc8dae549688f2bd6bfb", + "amountSats": 100000000 + } + ], + "tx": "020000000001021ae3614f251ce37d8a9514730e17068c60b46853d1bf515b825d1a51643067eb0000000000ffffffff49a39eef33a2b03cd9ac2ed493f1c19a67d269b499b728cd4d942bf119baf8840000000000ffffffff01c07fdc0b00000000225220525bedf0f14fdace49ed96c64c32603f79890443a3e97de56195e56c69b1282001400df5c1afc66e082e7812a648e8c7ae6274523d5742d3d93d15291e4ea75f1268dd98d2a1c579db4e9526b7bab0ef53868f532c722adf5deb569fe0f37ebde0c601212040ba76514a01b76d05a375a63122423b390bd68d9c11c9514353adb713991fbc00000000", + "valid": false, + "failureReason": "undefined sighash type" + }, + { + "id": "program-not-32-bytes", + "description": "Witness v2 output with a 33-byte witness program spent with an arbitrary witness", + "prevouts": [ + { + "scriptPubKey": "522185ea1c8b957e39246317d01dd5fba0526394b55775db91f32ffd6f983a64c0ec6d", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220e3c7e3c4b02437debd6e5ab4cf859378de04da3089be27fac7d7ee4143372075", + "amountSats": 100000000 + } + ], + "tx": "020000000001028a2396376d580b848cc4b43d0b0bb2e3481c75ba80be547df52b6069714540960000000000ffffffff2d63ef4986cd3f7b7e7a30bfce4028fd7ee5ca2032f4c2150af17cca84e55edc0000000000ffffffff01c07fdc0b000000002252209e1284ba591f050e4b1475d050d0d54048a15caf983a56b488d25d59f7854cba0101be0140b5908ddb2af07120008e4ed258b694708e8716e8fb09f67ecbf515ed38d74a2a955b82f310611829d7fed544ff91caeedccd90830070d10d4e50b71d35ff514200000000", + "valid": true + }, + { + "id": "program-offcurve-optout", + "description": "Opted-out input whose witness program is not a valid x-only public key", + "prevouts": [ + { + "scriptPubKey": "522064c3ae43dac00d99f5ebf5ec074d41a5e4e4ddb7c715564755696b7499d5665c", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52204a9fe450c24c111425a9dd4632f4fc94ed2714681717e369c059789e3751889e", + "amountSats": 100000000 + } + ], + "tx": "020000000001024dbb065d92ed45586f93ce8fea4d58381e09c3cb1bc7ebabb40e6d7e3fd87c3a0000000000ffffffffd9aef3faf3ec7368e3932fc48ee1f50a233573ecb42a05c886598994956e8abb0000000000ffffffff01c07fdc0b000000002252202991591a0ebcde9e2fd143ea0bda8265a67659aeeb5396935b4025e1c633d03001404ec4690ce502a5f0ab5fab245db9be42ccc650780be0f3ecaa4082a3a68a69428c363b40db3cf86e4251d733a577f3c994982e2965eac7a892e392126a29fcfa0140dca8295008d071fb0474bc62e696c9ec02aeb069e7ac044d901e1035219ba32ef6c045961be0ae75a69ec5c4ce1405624bd07e4f396ebbc0aa05d6dfb1df907600000000", + "valid": false, + "failureReason": "witness program is not a valid x-only public key" + }, + { + "id": "program-offcurve-in-group", + "description": "Half-aggregation group member whose witness program is not a valid x-only public key", + "prevouts": [ + { + "scriptPubKey": "52202b57dcc98a4977eb9e5d9c7d2b8b6ea7eccad98ee1a40f77dc43f80c94be5829", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52203ecbcb60ef10bbe471afc9317fda3ac61a26422688d9f9183484ea08b439ae94", + "amountSats": 100000000 + } + ], + "tx": "0200000000010273d7bf0559f1173564708c1e2d0ebe6175b72f5adee692dc6bf9ce52b75f038b0000000000ffffffff6e048d65284060c05b39ed176a8998ea32e8dd730eb3933a60e755796031f4a50000000000ffffffff01c07fdc0b00000000225220aa5413f1dcbd6a3f50db0278bcba58570af3e0d845807b5bcdabd92245739d1f01207ad0b4a52df2eb8e61ebbcf7f318dee3a1b54679c8e4314827a60d368633adbc0141f6a577712f6ee97781d101525cf34d0eb31471f35c85a2624ab257461e1ffedebd29211b614cf25019cd4345df309889ef09078f21c470907cea39c813e0b727bc00000000", + "valid": false, + "failureReason": "witness program is not a valid x-only public key" + }, + { + "id": "scriptpath-unknown-leaf-version", + "description": "Witness v2 script path spend with unknown leaf version 0xc2, which succeeds unconditionally per BIP 341", + "prevouts": [ + { + "scriptPubKey": "52203393a7b8c41d3c155cb9e1f9a49a76d1eef2c2de0b5fb76a693a7340001527d7", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52204b87263c4be4747effe770027e7677d8ec6bb46522c50a101d6d43c468265194", + "amountSats": 100000000 + } + ], + "tx": "02000000000102f9fba162f92dfd4eb91c55cdd8822a997bc4f4cce7e1dc7dd39debb837aa287a0000000000fffffffff82399ba5d5eaf6a581d7ac39883afc9e8f090134fea8afa3eb1c18b9b82c3c90000000000ffffffff01c07fdc0b00000000225220e524abd4c236566678fbb385b729120ef0e57b3ff78c055f807dc4a0ca615f6c02015121c3ab9432f842079557d76f597fdd75613784568e6d33b6a2ccb0cf7c442acf3e3e0140c37a2727f38a84eae22c1787d14dd7bb06b46f669014a13625247f5296d746431a21cfa521495a6c8e21de0354bec58ae96ab3bda0e70cce4b91fc4e6fe775a400000000", + "valid": true + }, + { + "id": "scriptpath-op-success", + "description": "Witness v2 script path spend whose leaf script is OP_SUCCESS188 (byte 0xbc), which succeeds unconditionally per BIP 342", + "prevouts": [ + { + "scriptPubKey": "52207696f7e30d71c62aa57ab70b23554a1084f6439b5163b07317f68986b71f0d24", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220f76f37ca6052b7292c8ad1572f57e33e106e04439d2dde833b8324c312bf46c3", + "amountSats": 100000000 + } + ], + "tx": "02000000000102122000b6c37db73bea687e47db28ec20c7c593e2c294223968607d1b18e075610000000000ffffffff65c38e05ba06fb03830ff257c768e439cb21820683af5f970d17a4403794c9dc0000000000ffffffff01c07fdc0b00000000225220abcc959351c9c6d270152cdb3be1b64b1c7a0755c325603899b33154e3b1c19b0201bc21c10d59725454cf341d2b7bc31c95f1149903f64c33e4baedee3a5669a3cf44633b01401673f6a61cbd094c1cce7f84184ff0b7b3f668d6c62d0fda29a9d1de40a4d44df26c9b6a47ebb3dff8ddf8ac379c3c36d6b1efebd5a0085af9920fc18568061000000000", + "valid": true + }, + { + "id": "v1-v2-mixed", + "description": "Witness v1 key path input alongside a two-member witness v2 half-aggregation group, mirroring Example 3 of the BIP", + "prevouts": [ + { + "scriptPubKey": "5120a65a8d02e401105e9e68fd11af633b2135be019ccbf71bfc5fbdfb8e44ba2df7", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220f943a227ca855dd9d22cf25837122a0f0dc129d77b452d8b2c20b2bc709bb684", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522015d5e4e64a5220c7d2c68f5b97454b29c08d6642720017e3ba8d1d133ce98cf6", + "amountSats": 100000000 + } + ], + "tx": "0200000000010399d38299f14c13d666e271ff326cf8c5e43e21d70826e4f1749566a3e80610b90000000000ffffffffeaa41167c8b8ee495014701bc627f54734586036efed5912e68d96b8fe4fd48a0000000000ffffffff78d37d165ff26a505a04c1d645f1f1d393645c7ab1b2fd81aeb429537ebe81670000000000ffffffff01c060d21100000000225220a65a8d02e401105e9e68fd11af633b2135be019ccbf71bfc5fbdfb8e44ba2df70140f631a1ffd1cf8f1fc640dfecc5453aec039f4cef7f807d5821f5750f2ca44bef7c304c558dcc7ac49b22a247c5c9992121fc0796a8b73b7113fd23b25e6d82480120683645a000862a928c89d3982224214f40ee17daa20b826a4c4a102e91d644cc01418a1dfc706d15974f9ef5509eaf0cd521da02f01decafe69045a15273c8ec7579a9411147dfdff7a48a7f7f140e9ea2a798c75107f234ab3d662abd0839dfcdbfbc00000000", + "valid": true + }, + { + "id": "sighash-byte-stripped", + "description": "Explicit SIGHASH_ALL byte removed from a group member by a third party", + "prevouts": [ + { + "scriptPubKey": "52205f56c844151d6ded6024f0c30ab90e436e03c5f199f66d77553fc0b8eee66377", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220366b81b84d19c39f58c8769cbd2b1f996542266c400c8de7e3997a5c143d7847", + "amountSats": 100000000 + } + ], + "tx": "02000000000102959f971cfdea5c89923108e7d2c9abf34a327ce3f0f1aa75e054f923b95b1cc20000000000ffffffff9e97d6493ed7423faad0636f6ba60f4a8eb6b26efa6e75513cf85da975c8c0eb0000000000ffffffff01c07fdc0b000000002252205f56c844151d6ded6024f0c30ab90e436e03c5f199f66d77553fc0b8eee663770120809b87ad64fd5246f69c246e81ef26c75323632c4016387b38efae7dd26155c501417699d8ab2d766b924d454eebadb25596d86b44d1895b713dd53f016cea6b9484086f137cb01dbbcfad2dcb2b787af3ad37644c2d366925a7ea9a7480e101ab19bc00000000", + "valid": false, + "failureReason": "signature message committed to the sighash type" + }, + { + "id": "empty-element-no-final", + "description": "Witness v2 input whose only witness element is empty, a full-aggregation member without a final input", + "prevouts": [ + { + "scriptPubKey": "522080348d8193f0b62e05f9614234c03965f9db14665f38523bfe4fa38bc9beb468", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220a6365e706c43c32a7382608828bf4d219302a520286b02487807e63e5765813d", + "amountSats": 100000000 + } + ], + "tx": "020000000001027b29d1ac4cd5356006588f0d3622ee61a6fc29ad2d299f2f6eb69cba0d7f5caf0000000000ffffffff9e6158b3c5934a484c25e47bd4dbbb3ca36c773d97a421e842806660232f0a0a0000000000ffffffff01c07fdc0b0000000022522080348d8193f0b62e05f9614234c03965f9db14665f38523bfe4fa38bc9beb468010001405c5072e8a3148f5207b21446e920e443315ec741a4155131b71a7742e178368ebfb9d951a452e076a30e245519fc7a9b2770d86ac3b758893a6f24a5e57ea7ca00000000", + "valid": false, + "failureReason": "aggregation group has no final input" + }, + { + "id": "sighash-single-no-output-group", + "description": "Half-aggregation group member uses SIGHASH_SINGLE at input index 1 of a single-output transaction", + "prevouts": [ + { + "scriptPubKey": "5220c8ce4e6a6a0d34357827bb0fe91cfd76f4dd76178783ade19eebf9709aa849f2", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220238b9c1c5f0a8267a1407055ab4710d68b6f17c78cae61a26bfde011ad304676", + "amountSats": 100000000 + } + ], + "tx": "0200000000010243255c54b0a85e8928e17b91f9f3f344372545f70a9c7e85450f4af1d2243cdd0000000000ffffffff45f25548efbd2113170e2c97cb5a2aecd9b0537956d766c60af33b54da9098320000000000ffffffff01c07fdc0b00000000225220c8ce4e6a6a0d34357827bb0fe91cfd76f4dd76178783ade19eebf9709aa849f20120ce3a7541d82797a2e57bc68ea3845186c806e3c73ec6655fa6c98c376df7ffc9014248021e012ca5c831276f4c79425029651ed38bf6082dd791094da491062fcbcb61cfd395216248969e859232af249893d8b277a805948efc56c13de102fffa6303bc00000000", + "valid": false, + "failureReason": "SIGHASH_SINGLE input without corresponding output" + }, + { + "id": "two-elements-no-annex", + "description": "Keypath-looking element followed by a second element that is not an annex, making this a script path spend with an invalid control block", + "prevouts": [ + { + "scriptPubKey": "52200391079747abc6405211bd3086ac8d0cfa8289c509120f63dfb37348df78178d", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52201e6238ab9bd6b76360d86ec5263f6de69dbd2d2766634cc4fa7d814328436633", + "amountSats": 100000000 + } + ], + "tx": "02000000000102796ded7d3a447a3c4a578f9535a9a52bf44b65d6bfd795fe142c0747df38c42c0000000000ffffffff679f42915303ad3f898d2b0bfee543aa568cb6478000e44e58c271f4b6e52f0a0000000000ffffffff01c07fdc0b000000002252200391079747abc6405211bd3086ac8d0cfa8289c509120f63dfb37348df78178d0240f0899cf64d99c1248b45e1a9978f13896fd52a7f2ba59fdbcc758795a455f34d90e892c51ca483cd2771e4bb2ca136dbfe0e95a5ee53bd80e71cdd6210dbbfa80160014068820e1acecedbb521e18d20bc0b7114fb391ce00e0b6e2eb1563b92cfcd9af64127a03b3cd230ed703e0cbf8a3fe1c6325ac9502db90c6278f11dd05c462d8f00000000", + "valid": false, + "failureReason": "invalid control block size" + }, + { + "id": "agg-mode-sig-as-optout", + "description": "Signature created over the half-aggregation flavored message used as a bare opted-out signature", + "prevouts": [ + { + "scriptPubKey": "5220f5550ce6e940cf53f9f175a7a81e18e4dd2dac375a4433ad15599979368aac14", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220d8846f187dc43f7a2df28b59753aad58bccbdb873fa0eb0dbc191edb6d322e12", + "amountSats": 100000000 + } + ], + "tx": "0200000000010274f6fcc771690ea6f38fc9df6d221ea9e858787d79b2e192f91b03f4e5ec59720000000000ffffffff038baab567625964cdcf30d6bc337418829f2699b28f0d51d8ef861a77dca5260000000000ffffffff01c07fdc0b00000000225220f5550ce6e940cf53f9f175a7a81e18e4dd2dac375a4433ad15599979368aac140140c16866682e8b6c0e2b0bb7d4fce36df1cbbfd1b10f29aa936aca928abb203aa72a37caac1975ead54822b06561aba975c1ce14229b89f66ce407b9ae88816fbc014041b811190dff556d541619af4bf934e6f2e6aedbf8ec343db834435c06f6d2faffe3b560cc7bba0a6dbf68806999533673228a010627603a69a19c89203b7fb800000000", + "valid": false, + "failureReason": "signature invalid, message commits to the aggregation mode" + }, + { + "id": "halfagg-large-group", + "description": "8-member half-aggregation group", + "prevouts": [ + { + "scriptPubKey": "52207ca5a23b5d8253b092e5e7c2ef60167966781689ccc0d311f119759beba0fba7", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52205eee9aada57d816a6cfbb21092b51b0e7fe93d2ee1f3dcd80e27343d419527f2", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522064d00057948fa1890a464fc996a8588b0ea8c6d2abe4c786a4cbc47d0c1cdd3c", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52201827c2d005bd8cb07201eee287ca25cd1e4b209e16fec42d3404fba65d68dc31", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220a8f1b32af980715b3538daa4af8da54ad9f5af4806855875ca955e85a8d807af", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52200a0448560df8dbe5e36c3563e2a51b20f0f08fc2cba5f139822958261ce4ce0d", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220e4b368758dd3b238a1705b26cb07df8cb2a2521773701b64c3b573c499526fc0", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52201bfa0b74a1992ae24806abbf2aac3c3f0fb77e2c64083cf2e70313d0214abd73", + "amountSats": 100000000 + } + ], + "tx": "02000000000108b8efc85febd6bd845177a7171d06cfd52e3a3c688dcfa32a8e8584841e838f770000000000ffffffffe3ef25b266108d5200cfd923167e4dd7b18072994257b674191ceafbed9f8cbf0000000000fffffffff535b8fca7bd89438e9ba575bdd71f12ececd5e34a7fe622459721dd437c71be0000000000ffffffff6fca2aaffb88ae969bcc62522629bb4e2e31af406a8fac5e2701bb6c3bb4305e0000000000ffffffffa026937889ed804a415cd70c9509dc7edf20ef28278ef23e35e2249f73457b570000000000ffffffff81a4bfd409211d0a308c24c36ded78110f5f5f751f00476ce9e06d6871b2d5690000000000ffffffff527ed3cee5f9c269fa74ac92fb266c65e61208faeb6b0619000dddda32cd167c0000000000ffffffffbde7534ac2149e11a2ccf7e7cdcf01964d068ca662df3d60c42e0cac08011bb30000000000ffffffff01c0c59f2f000000002252207ca5a23b5d8253b092e5e7c2ef60167966781689ccc0d311f119759beba0fba701209ec9d9e7172f588efca57173d91f63738dd5a9e4f6f03274046ecdbd854a224501206b1cf84508ca880021423f40ffca58ff5d32455ab00d96f0a729e0a72bfcbc530120187a1b6ab9fa96226abb5b47c18c489112924940f0f809230a904591290be90b0120c61c05f70bd771e926752988d74ced3f8bfe57d279f0464d626a1c2acc8a9da701209f714ccf3230608d91695e954826083061c02cfcc6fd11f5aa706e54e5da4f8d0120724731033b468ad8c6c6f3b36f479963651e153041dad5a7b74284b418a808730120ad8004c0267a9d9ed8a725046b66b6de030f6ce0d0c6f3a40bf1c2d29e46abdb0141c9e636dcde7f5c28cd5e18be362e44ce2da1e4a85ba62c99c777be590ed54af28fead4ab41aaa6020ee08ceb6c8a6aa1047e702fa200682bb526b9c5cee13fbcbc00000000", + "valid": true + }, + { + "id": "scriptpath-marker-lookalike", + "description": "Script path spend whose first stack element is a 1-byte 0xbc marker lookalike, which has no marker meaning outside key path spends", + "prevouts": [ + { + "scriptPubKey": "522082ace6d1d7a138a915bc07569161b1b6484d7c800b5e2fab8b573aa3dce40175", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220ffaa7773252d946733d00cc9870e80add10e577893ee972332c910dfe0f0b61c", + "amountSats": 100000000 + } + ], + "tx": "020000000001026c0780d0a76dc7e1f78a6fdcf25908625d50d37de0b055e4acd4198f23deb6a60000000000ffffffffd3c43fd83c79f225cf5208290086806fb0aab1111fcd10888aa972183b3c8fa10000000000ffffffff01c07fdc0b000000002252209895f077cf6760cdcdc729e244e345fe71f84d49bfd2958f01210a1737caf86e0301bc02755121c0c445296d4c0d625c2932df758a7f2a736d022bb6a55bb52c9eb52eb90ffea14f014014aa95ba5afcaaf375cb9515906433659f6e1157c49ee8cc43fab515753a3add50f5a25aeedc67bd8d079a66732d701700baec3143f45d859d41e2f75552284700000000", + "valid": true + }, + { + "id": "duplicate-key-groups", + "description": "Half-aggregation and full-aggregation groups whose two members each spend outputs with the same witness program (address reuse)", + "prevouts": [ + { + "scriptPubKey": "522098425d28f35f2da20c400f472183065fb5b221d6860962c68bb6d20bac20b081", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522098425d28f35f2da20c400f472183065fb5b221d6860962c68bb6d20bac20b081", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52206a0487f7f1b886fa757ea427cc370ff758c30e0e9ff194ebd20decb9a94eaa9d", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52206a0487f7f1b886fa757ea427cc370ff758c30e0e9ff194ebd20decb9a94eaa9d", + "amountSats": 100000000 + } + ], + "tx": "0200000000010491e7995af63730c1a6a372277b67a95dccb8610e91a99edfc1e91b227f7437830000000000ffffffff7ebcc3e7e23a3284bb376d66ed1e478a78d4c831e714adce963abd99630803360000000000ffffffff27f82605d137a2cda276cc7aec0e57862a1021b3ab26eb82202b14e50ab6fa5a0000000000ffffffffba4bce7307bda6108692c4b4e89eb98b7a0953ea26f798921557ffaac52b52120000000000ffffffff01c041c8170000000022522098425d28f35f2da20c400f472183065fb5b221d6860962c68bb6d20bac20b08101204134bd40de37fe40f669ede09cbdd10c8314072b79df64d1b1d5586fca61bad4014173b25c213b8dcc75caa9ae39e1dc8fd26f507f718c73ddf5cd387fbfafee290ef7d47987dfa68fc1e8ddf497a3f89e5c9bf7e18e47b7a6c0c723e2bb3bacaafebc01000141b0ce53001261d721870cc83f6db29306cef318174553b1a27539727596e64a597a3e78af413c287653f3bf8509e10fbf31330dea1df21d678e791b05e4050160bd00000000", + "valid": true + }, + { + "id": "v1-replay", + "description": "BIP 341 key path signature created for a witness v1 output with the same output key, replayed on a witness v2 input", + "prevouts": [ + { + "scriptPubKey": "52202cd9c8b80033c37a0fc7c1750bba8ef0237dde027d499b347f97243afba66cf8", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220223305cc0a35fa11e7df5671f3b486d54d50041e588279f354efb0363560ae1c", + "amountSats": 100000000 + } + ], + "tx": "0200000000010270f88f7e0757494753b48ec02fbc696341c643f5fc01bcfda556265680409e930000000000ffffffffea9615452372ede28c74eb220add491d09010ed9c8377b0605364c874eceedbc0000000000ffffffff01c07fdc0b000000002252202cd9c8b80033c37a0fc7c1750bba8ef0237dde027d499b347f97243afba66cf8014191871e1b8537b9aa04e14895ecafbbcf707878f7934924c6ba0928dab831949504b9f95ea86e183b573af36b1bdd9303df87efce00f52e4b42a53eeede13bec9810140800c07f424c186961c554602d1f24b8c33f5c748d48ce41c6e7f414c3ad7cfca1831928c88657c9ef46ca6e8d55e86500592e747ac72070c5fab00a7cf6b4dcd00000000", + "valid": false, + "failureReason": "signature message commits to the spent scriptPubKey" + }, + { + "id": "member-sighash-undefined", + "description": "Full-aggregation member with the undefined sighash value 0x04", + "prevouts": [ + { + "scriptPubKey": "522042df539f730080e1ed2376f765c6f2143089e4be7ce4d9bbe63e21af8e0b327f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522059089c0a85019600c1a1bb48a48a6002bdcade4d7d3dd5040ad52358c6dbca8f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52207bd2a9b241b649fc595db97b178f10e9dba8da55fa85a2a37b11abc16dd4f8de", + "amountSats": 100000000 + } + ], + "tx": "0200000000010382b704aa2b678bc8d052c0b677bc07167090116187ac01fd930a6b1eadc7b92b0000000000ffffffffc0d2d3ed02079c29fb00ba5ee6321e66dc9d50bd88deb26d5820d3246e31bd800000000000ffffffffdaac67e664466923982c4bef1018b5ae94a92b3fa10210b81c526c1e677dad5a0000000000ffffffff01c060d2110000000022522042df539f730080e1ed2376f765c6f2143089e4be7ce4d9bbe63e21af8e0b327f0140b0351faa8a03a5af239188bfd4fda857ccb3c1e00e24cb04d18e844eef2353c02f9e9f0e7de6f8348e004472073d7dc959729a174c5fa323160aefc4ced8a7d801010401417cbe8c2391b57f9ee9e8a5766efd036f137840e3ce5396e493b0f0477f7702ecda33c68372e0fee71579c9bf37230f2b2575bd4cb83c135afcee41b55a5f5289bd00000000", + "valid": false, + "failureReason": "undefined sighash type" + }, + { + "id": "halfagg-final-old-format", + "description": "97-byte 0xbc element carrying the whole aggregate signature, the final input encoding of an earlier revision", + "prevouts": [ + { + "scriptPubKey": "5220c3fdf588e2d9063fd7e49de5a97fbea45c7a4048430e88b23cda74997f8aa067", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220faddf6d6870b6ad1d3b6cc6af9e239764bc62363d2ca9e25d026447e06c7200a", + "amountSats": 100000000 + } + ], + "tx": "02000000000102917db2c3462c9895bdfa343f317c9112851662a05f7b39f639e735571aa1a3f40000000000ffffffffdde095c91533108ac01227dc10df531d73b5f8293a3b9dff3a9db994ce03a6b90000000000ffffffff01c07fdc0b00000000225220c3fdf588e2d9063fd7e49de5a97fbea45c7a4048430e88b23cda74997f8aa0670120121d1d860389ff25088bd64d369e28a218f93497dbefc0c48af074954dbf51820161121d1d860389ff25088bd64d369e28a218f93497dbefc0c48af074954dbf5182a1080a725a9558ee46904299e5e6eba263191a8dc096be7404f53e2e0f748cbd89c0ad029b07b446cdb07adcb3683e3c12b4044c6c7f3ecc2983fb8c394d174abc00000000", + "valid": false, + "failureReason": "marker and length match no defined structure" + }, + { + "id": "halfagg-acp-member", + "description": "Half-aggregation group with a SIGHASH_ALL|SIGHASH_ANYONECANPAY member", + "prevouts": [ + { + "scriptPubKey": "522089547531e583aef85d429080a8f251e040414fbdf72500ab72dcb9569830b6ce", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52206483a23467272265b2718d368b4b93d58f015c7d1b451f3e502ff90022bd6447", + "amountSats": 100000000 + } + ], + "tx": "0200000000010237978a1b66b8b936d709511aad50fc9fcb57ffd6ba379d35c6eb146292088f650000000000ffffffff00005b631d87e8087e2e92eeee47007c1869c2da602a1cdb353c8e1d1a919ac50000000000ffffffff01c07fdc0b0000000022522089547531e583aef85d429080a8f251e040414fbdf72500ab72dcb9569830b6ce0121b42ac8ee08116c28e76afe2d7897e52d8bd246df7926ed532a041a2b39d1f51c81014151f322bf3ad2c82e3871672b5d7abd003d3d4ac0a9a9773cd272b4940c4f14d7e1ce7f986bc713e990e4ece1aca38c298d5d0e78498bb7660cae3e22758f932cbc00000000", + "valid": true + }, + { + "id": "marker-swapped-fullagg", + "description": "Full-aggregation final of a single-member group mutated to carry the half-aggregation marker", + "prevouts": [ + { + "scriptPubKey": "522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b", + "amountSats": 100000000 + } + ], + "tx": "02000000000101787d107a893487240e835409c4cd5c68420bd6301ee936c2b201e90ad5bc8de60000000000ffffffff01c09ee6050000000022522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b0141918fef8d8d2d4312ea43c7aa3fa34f0827387318fe81fb1ad63b18d1f1e14c84e9bba54f4f81cb9d7bee3fcd0823a80af0c6608f54b83e935df1a632e2e03675bc00000000", + "valid": false, + "failureReason": "aggregate signature invalid, messages commit to the aggregation mode" + }, + { + "id": "annex-on-empty-member", + "description": "Full-aggregation member carrying an annex on an empty witness element, committed in its signature message", + "prevouts": [ + { + "scriptPubKey": "5220765b3ec5afb0323413e8493ed93c122a15ca3c48b88f1c2722db5247a5461c66", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220ace7e7d0e0a3391864ed53c0095c91b640015c66ee259c0112240609d03af626", + "amountSats": 100000000 + } + ], + "tx": "02000000000102a7f83858dde67a2b773c9ed4fd0a7c25a514c7a9fa70e7eb7b9449332c39a78a0000000000ffffffff805671eb757aac19fa56a255acda78df1b532c5220d31e44a7867cf187580b7e0000000000ffffffff01c07fdc0b00000000225220765b3ec5afb0323413e8493ed93c122a15ca3c48b88f1c2722db5247a5461c66020010504349534120616e6e6578207465737401419006ce438cce4f8458e1db2841a33fe053498b9a80bcb4d96937e169644bb817724dac0032d00ec30700d41c5e970ef8a38f85de0c709cd7fa6f5433aa606661bd00000000", + "valid": true + }, + { + "id": "nonce-shares-swapped", + "description": "Nonce shares of the two half-aggregation inputs swapped by a third party", + "prevouts": [ + { + "scriptPubKey": "5220c8ee60d3a8a37700930aa95a2f154b73e085ee38f21342bd19bad5c0e8fdbb12", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220f0daee3e78b7614a469644b6b9874c3fe530dfec8b580b3460da45badee74a4b", + "amountSats": 100000000 + } + ], + "tx": "02000000000102adfe07b3615f73ed6d91c6715e1640dc6520a75b9b7ef7423b0b681b1bef27fe0000000000ffffffff27fcd63dc25c409f3656d0c9d0f5fd700a53f1662cc135fa2033a1e16ede34d20000000000ffffffff01c07fdc0b00000000225220c8ee60d3a8a37700930aa95a2f154b73e085ee38f21342bd19bad5c0e8fdbb120120982c8e5359de318f5a83ccc2b269e56e10ea1d1f345cbc2e4c235f776f427d5701411a09701066a72dee917b725ecef1a881627254da5f4bc343ea799f92be885029dfead6af3b57c65f826607c045c13e268c94fa30c61dd2d47f500b2635e34ecebc00000000", + "valid": false, + "failureReason": "aggregate signature invalid, the randomizers commit to the shares in input order" + }, + { + "id": "optout-too-long", + "description": "66-byte element ending in a valid sighash byte, one byte above the opted-out maximum", + "prevouts": [ + { + "scriptPubKey": "522023bf6306a5bbd4682329b1f71463e8887beb5796e90a75f2cd20e14671bb3015", + "amountSats": 100000000 + }, + { + "scriptPubKey": "52205617de2e619bb3b360d9064287c2a285f7e79e6b67e7d8043122a7a1cbadaab5", + "amountSats": 100000000 + } + ], + "tx": "020000000001020c775db8b13f8dc047a1eaa9411b3d62762e8a9c51d02a2d1e6c083078d2630a0000000000ffffffff91c615ac861c12ddbfe825e9e3cf5bd952b839ba5d23add6ea92ff8c62e01faf0000000000ffffffff01c07fdc0b0000000022522023bf6306a5bbd4682329b1f71463e8887beb5796e90a75f2cd20e14671bb30150142b3ca4c0ef8058fc55d7886524ed2442f05df5f7c695abb0bf7ec001e125ba75f0964727fd1769c2c3fc6be4b42c7c822029e5815f36b36b54a7e950d4f80a263010101407276cf33f106c7809dde5d1104ab3893bbdaf09d61371d50db20b3435c719fb7d9d75257b5ed3d02db02dd46b92a187ab269f1d8d4f48f6aaac230d00ffa52e000000000", + "valid": false, + "failureReason": "marker and length match no defined structure" + }, + { + "id": "member-marker-only", + "description": "1-byte element containing only the marker value 0xbc, a full-aggregation member with an invalid sighash byte", + "prevouts": [ + { + "scriptPubKey": "5220d0c828d9203c41f97971718aed433eb578828f313d03913710a359005b7ddc52", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220f0c19ee28bd77735331185eff795ca94fb69075a820f243d1c2eacd32fe17df8", + "amountSats": 100000000 + } + ], + "tx": "02000000000102be96d771bfb90ce9b5fcf065da4f92446f4408b903f4c88e683728a45c8460080000000000ffffffff268e2af1032ee7d550b1345e9a43d03f0d0ca381b6f21dc1eb4988886107db8c0000000000ffffffff01c07fdc0b00000000225220d0c828d9203c41f97971718aed433eb578828f313d03913710a359005b7ddc520101bc0140a14a719ec76e7df2de4304059717acbff6e4daa7664213c5d129c03536725f31c13fe14b53a8a0043dec8d17efae3a21575ec120a0c6b6828d1691329646576900000000", + "valid": false, + "failureReason": "undefined sighash type" + }, + { + "id": "marker-swapped-halfagg", + "description": "Half-aggregation final of a single-member group mutated to carry the full-aggregation marker", + "prevouts": [ + { + "scriptPubKey": "5220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c6", + "amountSats": 100000000 + } + ], + "tx": "0200000000010187fea558630296d581abd8d24b147faeaa371a0d325edcf565b6719d8fd5ea310000000000ffffffff01c09ee60500000000225220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c60141bf6915975cc9bf5ab48830c0f34026519f668d453624848298d9e17fbf1362792f96def59bbab5ae47ab790704392b1e456703ad14bf72c375e874fff750dd1abd00000000", + "valid": false, + "failureReason": "aggregate signature invalid, messages commit to the aggregation mode" + }, + { + "id": "program-p2sh-wrapped", + "description": "P2SH-wrapped witness v2 program spent with an arbitrary witness", + "prevouts": [ + { + "scriptPubKey": "a9146f734c060625c563e3c0d3e5da4bc76e8afaecd587", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220f2359159005f32139c78f1b6dce2200144174ca9d3a463504a6c219cdf0b99de", + "amountSats": 100000000 + } + ], + "tx": "02000000000102bff0eb5a6843308cea82dd216d9ec19b40fbc69c5eb0f4e5b8afb29a6615f30d00000000232252206326b385529eaf837175ffc7a43fb8f0473aef0d7e6009acac99d03441429b44ffffffff6d79482f5753694077cd57a77b42cdc409f10b51ab4c92f099e0994e08f687cd0000000000ffffffff01c07fdc0b00000000225220fa783a5f6d85ed048693da0f2448fa62c5157d91c0c7b9f583112ac66f4a92c50101be01405803f82a11fe84888adba8af68e0db5d60b0ea39eb024bedb6ce3cae49129204beb9f09ba3197c9460bccd2c729c18385d256063e9db83734ff51f0afaac200b00000000", + "valid": true + }, + { + "id": "fullagg-sighash-types", + "description": "Full-aggregation group using SIGHASH_NONE, SIGHASH_SINGLE and the three ANYONECANPAY variants", + "prevouts": [ + { + "scriptPubKey": "5220248d6aac843ba2c515d8a85233835e494a24b39bdf8c61c4847718b7f8de6539", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522050bd285c9f0ac2d1b6975becde82a9995534b476b077c58b3eff71bb150b63fe", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220f9c3401834ca938140544f8e01f22163d8987ed840064233cbbc71007f59e190", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220e909277e8d402004f21527929264e8cc499c61b41f4de9ec21980e24ee5a3a0f", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220d6e0fd0789f7fc668cb7fc82f808b372fa49610cee8dc041d53c96228870f912", + "amountSats": 100000000 + } + ], + "tx": "0200000000010514a9d0a369dc71905754fae27a7aeb2bf887eacf9fde7fb809080b2ceb740f330000000000ffffffff913af883d8ef82edb6d5f0a4c30bf5cf2e4e11b4797c7f09fea9459cca06aec70000000000ffffffff90b8f457db9b004f63afec25a915af44a2df541efd0328ab917ce92e098bf2ee0000000000ffffffffca88518d7c2a42e8187a98888fe0713f62c27b2f8f94074128f9168a504bc1420000000000ffffffff2ac502ae8e38652a2b9dcba2913393e01919324ec726b94549761140cec6f92b0000000000ffffffff05c09ee60500000000225220248d6aac843ba2c515d8a85233835e494a24b39bdf8c61c4847718b7f8de6539c09ee6050000000022522050bd285c9f0ac2d1b6975becde82a9995534b476b077c58b3eff71bb150b63fec09ee60500000000225220f9c3401834ca938140544f8e01f22163d8987ed840064233cbbc71007f59e190c09ee60500000000225220e909277e8d402004f21527929264e8cc499c61b41f4de9ec21980e24ee5a3a0fc09ee60500000000225220d6e0fd0789f7fc668cb7fc82f808b372fa49610cee8dc041d53c96228870f9120101020101030101810101820142ffee77fc491829576fe0c16fa0024ef2559bb3b85259c2a5f69b6abe760b86b596c9e95e52df8838de704b6d18a02e6ffb2ff68821dcf4157d432bdc76a5f63583bd00000000", + "valid": true + }, + { + "id": "halfagg-sighash-types", + "description": "Half-aggregation group using SIGHASH_NONE, SIGHASH_NONE|ANYONECANPAY and SIGHASH_SINGLE|ANYONECANPAY", + "prevouts": [ + { + "scriptPubKey": "522044e0228edfee942aa38d8f600bfb2ffb8609d722a7736e55e50d3918fea31283", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522031f28cd51fd56e0486abaac65caf0a26742f51b7594da67170e62451967c6076", + "amountSats": 100000000 + }, + { + "scriptPubKey": "522085bb5830e3a3ea27b68dcdbeb705194aecb2c9c48c85dbe2d691fe158f4ddd5a", + "amountSats": 100000000 + } + ], + "tx": "0200000000010308bfaaea3a06c977ced6c3d5c40c8f6cf305e8757c4a78613afe4b11e062bbbd0000000000ffffffffb385c8da4663b73a72120c82298965767d2751520756ee2b02775a28900b7fc00000000000ffffffff641c89dfb11a88a010794dd8aa528e3283c8908325ab6c0cfd7fdd5fed7a0ac00000000000ffffffff03c09ee6050000000022522044e0228edfee942aa38d8f600bfb2ffb8609d722a7736e55e50d3918fea31283c09ee6050000000022522031f28cd51fd56e0486abaac65caf0a26742f51b7594da67170e62451967c6076c09ee6050000000022522085bb5830e3a3ea27b68dcdbeb705194aecb2c9c48c85dbe2d691fe158f4ddd5a0121fe03e4c0af0b994a52f585e0dc1f9fbcb2880d901c2c94f515be2bee985d595a020121364fabaa9c04da02654e8bfddf9e247331f3cb5f5c8c68718da6dfe8908a4445820142347423722a5d47f98bbe2d14975d20901e69f398b73967151b00ba258d0781e2802df3a8b48bc5abe52eb2161e0e00c6b017a5e42bc27034dccc6b4fe6ded35a83bc00000000", + "valid": true + } + ] +} diff --git a/bip-0460/test-vectors.py b/bip-0460/test-vectors.py new file mode 100644 index 00000000..5df73cd6 --- /dev/null +++ b/bip-0460/test-vectors.py @@ -0,0 +1,1506 @@ +#!/usr/bin/env python3 +""" +Test vector generator for the CISA Taproot key path BIP (witness v2). + +Generates two files: + wallet-test-vectors.json scriptPubKey/address derivation, sighash + computation, and witness construction + consensus-test-vectors.json transaction level valid/invalid cases + +WARNING: All keys and nonces in this file are deterministic and publicly +known. They exist only to make the vectors reproducible. Never use this +code or these values in production. +""" + +import hashlib +import json +import sys +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).parent / "secp256k1lab/src")) +sys.path.insert(0, str(Path(__file__).parent)) + +from secp256k1lab.secp256k1 import G, GE, Scalar +from secp256k1lab.bip340 import schnorr_sign, schnorr_verify +from secp256k1lab.util import tagged_hash + +import halfagg +import fullagg + +# Marker bytes +MARKER_HALFAGG = 0xBC +MARKER_FULLAGG = 0xBD + +# Sighash epoch for aggregated witness v2 signature messages +SIGHASH_EPOCH = 0x01 + +SIGHASH_DEFAULT = 0x00 +SIGHASH_ALL = 0x01 +SIGHASH_NONE = 0x02 +SIGHASH_SINGLE = 0x03 +SIGHASH_ANYONECANPAY = 0x80 + +AUX_ZERO = bytes(32) + + +# --------------------------------------------------------------------------- +# Serialization helpers +# --------------------------------------------------------------------------- + +def sha256(b): + return hashlib.sha256(b).digest() + + +def ser_compact_size(n): + if n < 253: + return bytes([n]) + if n < 0x10000: + return b"\xfd" + n.to_bytes(2, "little") + if n < 0x100000000: + return b"\xfe" + n.to_bytes(4, "little") + return b"\xff" + n.to_bytes(8, "little") + + +class TxIn: + def __init__(self, txid, vout, sequence=0xFFFFFFFF, script_sig=b""): + self.txid = txid # 32 bytes, internal byte order + self.vout = vout + self.sequence = sequence + self.script_sig = script_sig + + def outpoint(self): + return self.txid + self.vout.to_bytes(4, "little") + + +class TxOut: + def __init__(self, amount, script_pubkey): + self.amount = amount + self.script_pubkey = script_pubkey + + def serialize(self): + return self.amount.to_bytes(8, "little") + ser_compact_size( + len(self.script_pubkey) + ) + self.script_pubkey + + +class Tx: + def __init__(self, vin, vout, version=2, locktime=0): + self.version = version + self.locktime = locktime + self.vin = vin + self.vout = vout + self.witnesses = [[] for _ in vin] + + def serialize_unsigned(self): + out = self.version.to_bytes(4, "little") + out += ser_compact_size(len(self.vin)) + for txin in self.vin: + out += (txin.outpoint() + ser_compact_size(len(txin.script_sig)) + + txin.script_sig + txin.sequence.to_bytes(4, "little")) + out += ser_compact_size(len(self.vout)) + for txout in self.vout: + out += txout.serialize() + out += self.locktime.to_bytes(4, "little") + return out + + def serialize_signed(self): + out = self.version.to_bytes(4, "little") + out += b"\x00\x01" + out += ser_compact_size(len(self.vin)) + for txin in self.vin: + out += (txin.outpoint() + ser_compact_size(len(txin.script_sig)) + + txin.script_sig + txin.sequence.to_bytes(4, "little")) + out += ser_compact_size(len(self.vout)) + for txout in self.vout: + out += txout.serialize() + for witness in self.witnesses: + out += ser_compact_size(len(witness)) + for element in witness: + out += ser_compact_size(len(element)) + element + out += self.locktime.to_bytes(4, "little") + return out + + +# --------------------------------------------------------------------------- +# Taproot style key derivation +# --------------------------------------------------------------------------- + +def tweak_keypair(seckey32): + d0 = Scalar.from_bytes_checked(seckey32) + P = d0 * G + d = d0 if P.has_even_y() else -d0 + internal_pubkey = P.to_bytes_xonly() + t = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_pubkey)) + Q = (d + t) * G + tweaked_seckey = (d + t).to_bytes() + return internal_pubkey, t.to_bytes(), tweaked_seckey, Q.to_bytes_xonly() + + +def v2_script_pubkey(output_key32): + return bytes([0x52, 0x20]) + output_key32 + + +# --------------------------------------------------------------------------- +# Bech32m (adapted from the BIP 350 reference implementation) +# --------------------------------------------------------------------------- + +CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l" +BECH32M_CONST = 0x2BC830A3 + + +def bech32_polymod(values): + generator = [0x3B6A57B2, 0x26508E6D, 0x1EA119FA, 0x3D4233DD, 0x2A1462B3] + chk = 1 + for value in values: + top = chk >> 25 + chk = (chk & 0x1FFFFFF) << 5 ^ value + for i in range(5): + chk ^= generator[i] if ((top >> i) & 1) else 0 + return chk + + +def bech32_hrp_expand(hrp): + return [ord(x) >> 5 for x in hrp] + [0] + [ord(x) & 31 for x in hrp] + + +def bech32m_create_checksum(hrp, data): + values = bech32_hrp_expand(hrp) + data + polymod = bech32_polymod(values + [0, 0, 0, 0, 0, 0]) ^ BECH32M_CONST + return [(polymod >> 5 * (5 - i)) & 31 for i in range(6)] + + +def convertbits(data, frombits, tobits, pad=True): + acc = 0 + bits = 0 + ret = [] + maxv = (1 << tobits) - 1 + for value in data: + acc = (acc << frombits) | value + bits += frombits + while bits >= tobits: + bits -= tobits + ret.append((acc >> bits) & maxv) + if pad and bits: + ret.append((acc << (tobits - bits)) & maxv) + return ret + + +def v2_address(output_key32, hrp="bc"): + data = [2] + convertbits(output_key32, 8, 5) + combined = data + bech32m_create_checksum(hrp, data) + return hrp + "1" + "".join([CHARSET[d] for d in combined]) + + +# --------------------------------------------------------------------------- +# Witness v2 common signature message +# --------------------------------------------------------------------------- + +def sigmsg_common(tx, spent_utxos, input_index, hash_type, ext_flag, annex=None): + """Compute SigMsg(hash_type, ext_flag) as defined in BIP 341.""" + assert len(spent_utxos) == len(tx.vin) + anyonecanpay = bool(hash_type & SIGHASH_ANYONECANPAY) + base_type = hash_type & 3 + + msg = bytes([hash_type]) + msg += tx.version.to_bytes(4, "little") + msg += tx.locktime.to_bytes(4, "little") + if not anyonecanpay: + msg += sha256(b"".join(txin.outpoint() for txin in tx.vin)) + msg += sha256(b"".join(u.amount.to_bytes(8, "little") for u in spent_utxos)) + msg += sha256( + b"".join( + ser_compact_size(len(u.script_pubkey)) + u.script_pubkey + for u in spent_utxos + ) + ) + msg += sha256( + b"".join(txin.sequence.to_bytes(4, "little") for txin in tx.vin) + ) + if base_type not in (SIGHASH_NONE, SIGHASH_SINGLE): + msg += sha256(b"".join(txout.serialize() for txout in tx.vout)) + spend_type = 2 * ext_flag + (1 if annex is not None else 0) + msg += bytes([spend_type]) + if anyonecanpay: + txin = tx.vin[input_index] + utxo = spent_utxos[input_index] + msg += txin.outpoint() + msg += utxo.amount.to_bytes(8, "little") + msg += ser_compact_size(len(utxo.script_pubkey)) + utxo.script_pubkey + msg += txin.sequence.to_bytes(4, "little") + else: + msg += input_index.to_bytes(4, "little") + if annex is not None: + msg += sha256(ser_compact_size(len(annex)) + annex) + if base_type == SIGHASH_SINGLE: + msg += sha256(tx.vout[input_index].serialize()) + return msg + + +def sigmsg_v2(tx, spent_utxos, input_index, hash_type, agg_mode, annex=None): + """Compute hash_TapSighash(0x01 || agg_mode || SigMsg(hash_type, 0)).""" + msg = sigmsg_common(tx, spent_utxos, input_index, hash_type, 0, annex) + return tagged_hash("TapSighash", bytes([SIGHASH_EPOCH, agg_mode]) + msg) + + +def sigmsg_tapscript(tx, spent_utxos, input_index, hash_type, tapleaf_hash, + annex=None): + """Compute the unchanged BIP 342 tapscript signature message, + hash_TapSighash(0x00 || SigMsg(hash_type, 1) || ext).""" + msg = sigmsg_common(tx, spent_utxos, input_index, hash_type, 1, annex) + ext = tapleaf_hash + b"\x00" + b"\xff\xff\xff\xff" + return tagged_hash("TapSighash", bytes([0x00]) + msg + ext) + + +def sigmsg_v1(tx, spent_utxos, input_index, hash_type, annex=None): + """Compute the unchanged BIP 341 key path signature message, + hash_TapSighash(0x00 || SigMsg(hash_type, 0)).""" + msg = sigmsg_common(tx, spent_utxos, input_index, hash_type, 0, annex) + return tagged_hash("TapSighash", bytes([0x00]) + msg) + + +# --------------------------------------------------------------------------- +# Witness element construction +# --------------------------------------------------------------------------- + +def marker_element(marker, hash_type=SIGHASH_DEFAULT, sig=b""): + element = sig + if hash_type != SIGHASH_DEFAULT: + element += bytes([hash_type]) + return element + bytes([marker]) + + +def optout_element(sig, hash_type=SIGHASH_DEFAULT): + if hash_type == SIGHASH_DEFAULT: + return sig + return sig + bytes([hash_type]) + + +def halfagg_member(nonce_share, hash_type=SIGHASH_DEFAULT): + if hash_type == SIGHASH_DEFAULT: + return nonce_share + return nonce_share + bytes([hash_type]) + + +def fullagg_member(hash_type=SIGHASH_DEFAULT): + if hash_type == SIGHASH_DEFAULT: + return b"" + return bytes([hash_type]) + + +def halfagg_final(aggsig, hash_type=SIGHASH_DEFAULT): + return marker_element(MARKER_HALFAGG, hash_type, aggsig[-64:]) + + +# --------------------------------------------------------------------------- +# Deterministic test data +# --------------------------------------------------------------------------- + +def test_seckey(i): + return tagged_hash("CISA/test/key", bytes([i])) + + +def test_prevout_txid(i): + return sha256(b"CISA vector prevout " + bytes([i])) + + +def test_fullagg_secnonce(i): + # Test-only deterministic nonces. Nonces must be fresh uniform + # randomness in any real signing session. + r1 = Scalar.from_bytes_wrapping(tagged_hash("CISA/test/nonce", bytes([i, 0]))) + r2 = Scalar.from_bytes_wrapping(tagged_hash("CISA/test/nonce", bytes([i, 1]))) + return (r1, r2), (r1 * G, r2 * G) + + +def test_garbage(label, length=32): + out = b"" + i = 0 + while len(out) < length: + out += tagged_hash("CISA/test/garbage", label + bytes([i])) + i += 1 + return out[:length] + + +def test_offcurve_x(label): + # Deterministically find 32 bytes that are not a valid x coordinate. + i = 0 + while True: + cand = tagged_hash("CISA/test/offcurve", label + bytes([i])) + try: + GE.from_bytes_xonly(cand) + except ValueError: + return cand + i += 1 + + +# --------------------------------------------------------------------------- +# Signing helpers +# --------------------------------------------------------------------------- + +def sign_optout(tx, utxos, idx, tweaked_seckey, hash_type): + m = sigmsg_v1(tx, utxos, idx, hash_type) + sig = schnorr_sign(m, tweaked_seckey, AUX_ZERO) + return m, sig + + +def sign_halfagg_group(tx, utxos, members): + """members: list of (input_index, tweaked_seckey, hash_type). + Returns (msgs, plain_sigs, aggsig).""" + triples = [] + msgs = [] + for idx, sk, ht in members: + m = sigmsg_v2(tx, utxos, idx, ht, MARKER_HALFAGG) + sig = schnorr_sign(m, sk, AUX_ZERO) + pk = utxos[idx].script_pubkey[2:] + triples.append((pk, m, sig)) + msgs.append(m) + aggsig = halfagg.Aggregate(triples) + assert halfagg.VerifyAggregate(aggsig, [(pk, m) for pk, m, _ in triples]) + return msgs, [t[2] for t in triples], aggsig + + +def sign_fullagg_group(tx, utxos, members, msg_mode=MARKER_FULLAGG, + nonce_offset=0, annexes=None): + """members: list of (input_index, tweaked_seckey, hash_type). + msg_mode overrides the marker committed in the signature messages, + with None selecting the plain BIP 341 message, used by negative + vectors exercising the mode commitment. + nonce_offset varies the deterministic test nonces between sessions. + annexes optionally maps input indices to their annex. + Returns (msgs, secnonces, pubnonces, sig64).""" + pks = [] + msgs = [] + secnonces = [] + pubnonces = [] + for i, (idx, sk, ht) in enumerate(members): + annex = annexes.get(idx) if annexes else None + if msg_mode is None: + m = sigmsg_v1(tx, utxos, idx, ht, annex=annex) + else: + m = sigmsg_v2(tx, utxos, idx, ht, msg_mode, annex=annex) + msgs.append(m) + pks.append(GE.from_bytes_xonly(utxos[idx].script_pubkey[2:])) + secnonce, pubnonce = test_fullagg_secnonce(i + nonce_offset) + secnonces.append(secnonce) + pubnonces.append(pubnonce) + aggnonce = fullagg.NonceAgg(pubnonces) + psigs = [] + for i, (idx, sk, ht) in enumerate(members): + d = Scalar.from_bytes_checked(sk) + psig = fullagg.Sign(secnonces[i], d, msgs[i], aggnonce, pks, msgs, pubnonces) + psigs.append(psig) + R, s = fullagg.SigAgg(aggnonce, pks, msgs, pubnonces, psigs) + assert fullagg.Verify(pks, msgs, (R, s)) + sig64 = R.to_bytes_xonly() + s.to_bytes() + return msgs, secnonces, pubnonces, sig64 + + +# --------------------------------------------------------------------------- +# Vector construction +# --------------------------------------------------------------------------- + +def hexlify(b): + return b.hex() + + +def make_wallet_vectors(): + vectors = {"scriptPubKey": [], "keyPathSpending": []} + + # scriptPubKey and address derivation + for i in range(2): + seckey = test_seckey(i) + internal_pubkey, tweak, tweaked_seckey, output_key = tweak_keypair(seckey) + spk = v2_script_pubkey(output_key) + vectors["scriptPubKey"].append( + { + "given": {"internalPubkey": hexlify(internal_pubkey)}, + "intermediary": { + "tweak": hexlify(tweak), + "tweakedPubkey": hexlify(output_key), + }, + "expected": { + "scriptPubKey": hexlify(spk), + "address": v2_address(output_key), + }, + } + ) + + # Case 1: opted-out input plus a two-member half-aggregation group + keys = [tweak_keypair(test_seckey(i)) for i in range(3)] + utxos = [ + TxOut(100_000_000 + i * 1_000_000, v2_script_pubkey(k[3])) + for i, k in enumerate(keys) + ] + tx = Tx( + vin=[TxIn(test_prevout_txid(i), 0) for i in range(3)], + vout=[TxOut(299_000_000, v2_script_pubkey(keys[0][3]))], + ) + m0, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_ALL) + msgs, sigs, aggsig = sign_halfagg_group( + tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT), (2, keys[2][2], SIGHASH_DEFAULT)] + ) + tx.witnesses[0] = [optout_element(sig0, SIGHASH_ALL)] + tx.witnesses[1] = [halfagg_member(sigs[0][:32])] + tx.witnesses[2] = [halfagg_final(aggsig)] + + case1 = { + "description": "Opted-out input with SIGHASH_ALL alongside a " + "two-member half-aggregation group with SIGHASH_DEFAULT", + "given": { + "rawUnsignedTx": hexlify(tx.serialize_unsigned()), + "utxosSpent": [ + {"scriptPubKey": hexlify(u.script_pubkey), "amountSats": u.amount} + for u in utxos + ], + }, + "inputSpending": [], + "auxiliary": {"aggregateSignature": hexlify(aggsig)}, + "expected": {"rawSignedTx": hexlify(tx.serialize_signed())}, + } + input_data = [ + (0, None, SIGHASH_ALL, m0), + (1, MARKER_HALFAGG, SIGHASH_DEFAULT, msgs[0]), + (2, MARKER_HALFAGG, SIGHASH_DEFAULT, msgs[1]), + ] + for idx, marker, ht, m in input_data: + case1["inputSpending"].append( + { + "given": { + "txinIndex": idx, + "internalPrivkey": hexlify(test_seckey(idx)), + "aggMode": None if marker is None else f"0x{marker:02x}", + "hashType": ht, + }, + "intermediary": { + "internalPubkey": hexlify(keys[idx][0]), + "tweak": hexlify(keys[idx][1]), + "tweakedPrivkey": hexlify(keys[idx][2]), + "sigHash": hexlify(m), + }, + "expected": {"witness": [hexlify(e) for e in tx.witnesses[idx]]}, + } + ) + vectors["keyPathSpending"].append(case1) + + # Case 2: two-member full-aggregation group + keys = [tweak_keypair(test_seckey(i + 3)) for i in range(2)] + utxos = [ + TxOut(50_000_000, v2_script_pubkey(keys[0][3])), + TxOut(70_000_000, v2_script_pubkey(keys[1][3])), + ] + tx = Tx( + vin=[TxIn(test_prevout_txid(i + 3), 1) for i in range(2)], + vout=[TxOut(119_000_000, v2_script_pubkey(keys[0][3]))], + ) + msgs, secnonces, pubnonces, sig64 = sign_fullagg_group( + tx, utxos, [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_ALL)] + ) + tx.witnesses[0] = [fullagg_member(SIGHASH_ALL)] + tx.witnesses[1] = [marker_element(MARKER_FULLAGG, SIGHASH_ALL, sig64)] + + case2 = { + "description": "Two-member full-aggregation group with SIGHASH_ALL " + "(using deterministic nonces)", + "given": { + "rawUnsignedTx": hexlify(tx.serialize_unsigned()), + "utxosSpent": [ + {"scriptPubKey": hexlify(u.script_pubkey), "amountSats": u.amount} + for u in utxos + ], + }, + "inputSpending": [], + "auxiliary": { + "secnonces": [ + hexlify(r1.to_bytes() + r2.to_bytes()) for r1, r2 in secnonces + ], + "pubnonces": [ + hexlify(R1.to_bytes_compressed() + R2.to_bytes_compressed()) + for R1, R2 in pubnonces + ], + "aggregateSignature": hexlify(sig64), + }, + "expected": {"rawSignedTx": hexlify(tx.serialize_signed())}, + } + for idx in range(2): + case2["inputSpending"].append( + { + "given": { + "txinIndex": idx, + "internalPrivkey": hexlify(test_seckey(idx + 3)), + "aggMode": f"0x{MARKER_FULLAGG:02x}", + "hashType": SIGHASH_ALL, + }, + "intermediary": { + "internalPubkey": hexlify(keys[idx][0]), + "tweak": hexlify(keys[idx][1]), + "tweakedPrivkey": hexlify(keys[idx][2]), + "sigHash": hexlify(msgs[idx]), + }, + "expected": {"witness": [hexlify(e) for e in tx.witnesses[idx]]}, + } + ) + vectors["keyPathSpending"].append(case2) + + # Case 3: script path spend of a witness v2 output (BIP 341/342 rules + # unchanged). Same leaf and keys as the consensus scriptpath-valid + # case, so the two files cross-check. + script_seckey = test_seckey(20) + script_pk = (Scalar.from_bytes_checked(script_seckey) * G).to_bytes_xonly() + script = bytes([0x20]) + script_pk + bytes([0xAC]) # OP_CHECKSIG + tapleaf_hash = tagged_hash( + "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script)) + script + ) + internal_seckey = test_seckey(21) + internal_x = (Scalar.from_bytes_checked(internal_seckey) * G).to_bytes_xonly() + t = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x + tapleaf_hash)) + Q = GE.from_bytes_xonly(internal_x) + t * G + control = bytes([0xC0 | (0 if Q.has_even_y() else 1)]) + internal_x + spk = v2_script_pubkey(Q.to_bytes_xonly()) + utxos = [TxOut(100_000_000, spk)] + dest_key = tweak_keypair(test_seckey(0))[3] + tx = Tx( + vin=[TxIn(test_prevout_txid(33), 0)], + vout=[TxOut(99_000_000, v2_script_pubkey(dest_key))], + ) + m_script = sigmsg_tapscript(tx, utxos, 0, SIGHASH_DEFAULT, tapleaf_hash) + sig_script = schnorr_sign(m_script, script_seckey, AUX_ZERO) + assert schnorr_verify(m_script, script_pk, sig_script) + tx.witnesses[0] = [sig_script, script, control] + + vectors["scriptPathSpending"] = [ + { + "description": "Script path spend of a witness v2 output with a " + "single CHECKSIG leaf, following BIP 341/342 unchanged", + "given": { + "rawUnsignedTx": hexlify(tx.serialize_unsigned()), + "utxosSpent": [ + {"scriptPubKey": hexlify(u.script_pubkey), + "amountSats": u.amount} + for u in utxos + ], + "internalPubkey": hexlify(internal_x), + "script": hexlify(script), + "leafVersion": "0xc0", + "hashType": SIGHASH_DEFAULT, + }, + "intermediary": { + "leafHash": hexlify(tapleaf_hash), + "tweak": hexlify(t.to_bytes()), + "tweakedPubkey": hexlify(Q.to_bytes_xonly()), + "controlBlock": hexlify(control), + "sigHash": hexlify(m_script), + }, + "expected": { + "scriptPubKey": hexlify(spk), + "address": v2_address(Q.to_bytes_xonly()), + "witness": [hexlify(e) for e in tx.witnesses[0]], + "rawSignedTx": hexlify(tx.serialize_signed()), + }, + } + ] + + return vectors + + +def make_consensus_vectors(): + cases = [] + + def add_case(case_id, description, tx, utxos, valid, failure_reason=None): + case = { + "id": case_id, + "description": description, + "prevouts": [ + {"scriptPubKey": hexlify(u.script_pubkey), "amountSats": u.amount} + for u in utxos + ], + "tx": hexlify(tx.serialize_signed()), + "valid": valid, + } + if failure_reason is not None: + case["failureReason"] = failure_reason + cases.append(case) + + def fresh_setup(num_inputs, key_offset=0): + keys = [tweak_keypair(test_seckey(i + key_offset)) for i in range(num_inputs)] + utxos = [ + TxOut(100_000_000, v2_script_pubkey(k[3])) for k in keys + ] + tx = Tx( + vin=[TxIn(test_prevout_txid(i + key_offset), 0) for i in range(num_inputs)], + vout=[TxOut(num_inputs * 100_000_000 - 1_000_000, + v2_script_pubkey(keys[0][3]))], + ) + return keys, utxos, tx + + # 1: valid two-member half-aggregation group with explicit sighash + # forms + keys, utxos, tx = fresh_setup(2) + _, sigs1, aggsig = sign_halfagg_group( + tx, utxos, [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_ALL)] + ) + tx.witnesses[0] = [halfagg_member(sigs1[0][:32], SIGHASH_ALL)] + tx.witnesses[1] = [halfagg_final(aggsig, SIGHASH_ALL)] + add_case("halfagg-valid", "Two-member half-aggregation group, SIGHASH_ALL", + tx, utxos, True) + + # 2: valid two-member full-aggregation group + keys, utxos, tx = fresh_setup(2, key_offset=3) + _, _, _, sig64 = sign_fullagg_group( + tx, utxos, [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_ALL)] + ) + tx.witnesses[0] = [fullagg_member(SIGHASH_ALL)] + tx.witnesses[1] = [marker_element(MARKER_FULLAGG, SIGHASH_ALL, sig64)] + add_case("fullagg-valid", "Two-member full-aggregation group, SIGHASH_ALL", + tx, utxos, True) + fullagg_base = (keys, utxos, tx, sig64) + + # 3: valid mix of opted-out input and half-aggregation group + keys, utxos, tx = fresh_setup(3, key_offset=6) + _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT) + _, sigs3, aggsig3 = sign_halfagg_group( + tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT), (2, keys[2][2], SIGHASH_DEFAULT)] + ) + tx.witnesses[0] = [optout_element(sig0)] + tx.witnesses[1] = [halfagg_member(sigs3[0][:32])] + tx.witnesses[2] = [halfagg_final(aggsig3)] + add_case("mixed-valid", + "Opted-out input alongside a two-member half-aggregation group", + tx, utxos, True) + + # 4: invalid, undefined sighash value 0xbb. The signature covers the + # message that hashes 0xbb, so only the sighash validation fails. + keys, utxos, tx = fresh_setup(3, key_offset=6) + _, sig0_4 = sign_optout(tx, utxos, 0, keys[0][2], 0xBB) + tx.witnesses[0] = [sig0_4 + bytes([0xBB])] + tx.witnesses[1] = [halfagg_member(sigs3[0][:32])] + tx.witnesses[2] = [halfagg_final(aggsig3)] + add_case("optout-sighash-undefined", "65-byte opted-out signature ending in " + "the undefined sighash value 0xbb", tx, utxos, False, + "undefined sighash type") + + # 5: invalid, explicit 0x00 sighash byte on a group member + keys, utxos, tx = fresh_setup(3, key_offset=6) + tx.witnesses[0] = [optout_element(sig0)] + tx.witnesses[1] = [sigs3[0][:32] + bytes([0x00])] + tx.witnesses[2] = [halfagg_final(aggsig3)] + add_case("member-explicit-default", "Half-aggregation member encodes " + "SIGHASH_DEFAULT explicitly as a 0x00 sighash byte", + tx, utxos, False, "explicit 0x00 sighash byte") + + # 6: invalid, aggregation group without a final input + keys, utxos, tx = fresh_setup(2) + tx.witnesses[0] = [halfagg_member(sigs1[0][:32])] + tx.witnesses[1] = [halfagg_member(sigs1[1][:32])] + add_case("group-no-final", "Half-aggregation members without an input " + "carrying the marker and the s value", tx, utxos, False, + "aggregation group has no final input") + + # 7: invalid, member after the group final + keys, utxos, tx = fresh_setup(3, key_offset=9) + _, sigs7, aggsig7 = sign_halfagg_group( + tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)] + ) + tx.witnesses[0] = [halfagg_member(sigs7[0][:32])] + tx.witnesses[1] = [halfagg_final(aggsig7)] + tx.witnesses[2] = [halfagg_member(sigs7[1][:32])] + add_case("member-after-final", "Half-aggregation member appears after " + "the group's final input", tx, utxos, False, + "member after group final") + + # 8: invalid, 2-byte element. No defined form has two bytes. + keys, utxos, tx = fresh_setup(2) + _, sig1_8 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [bytes([SIGHASH_ALL, MARKER_HALFAGG])] + tx.witnesses[1] = [optout_element(sig1_8)] + add_case("element-length-undefined", "2-byte witness element ending in " + "a marker byte, matching no defined structure", tx, utxos, + False, "marker and length match no defined structure") + + # 9: invalid, cross-mode fold (mode commitment) + # Opted-out signatures over the plain BIP 341 message are packaged + # as a half-aggregation group. The group structure is well formed + # but aggregate verification fails because the group messages commit + # to the aggregation mode. + keys, utxos, tx = fresh_setup(2, key_offset=12) + triples = [] + for idx in range(2): + m_optout = sigmsg_v1(tx, utxos, idx, SIGHASH_DEFAULT) + sig = schnorr_sign(m_optout, keys[idx][2], AUX_ZERO) + pk = utxos[idx].script_pubkey[2:] + triples.append((pk, m_optout, sig)) + aggsig9 = halfagg.Aggregate(triples) + consensus_msgs = [ + (utxos[i].script_pubkey[2:], + sigmsg_v2(tx, utxos, i, SIGHASH_DEFAULT, MARKER_HALFAGG)) + for i in range(2) + ] + assert not halfagg.VerifyAggregate(aggsig9, consensus_msgs) + tx.witnesses[0] = [halfagg_member(triples[0][2][:32])] + tx.witnesses[1] = [halfagg_final(aggsig9)] + add_case("cross-mode-fold", "Opted-out signatures folded into a " + "half-aggregation group by a third party", tx, utxos, False, + "aggregate signature invalid, messages commit to the " + "aggregation mode") + + # 10: invalid, empty witness + keys, utxos, tx = fresh_setup(2) + _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [] + tx.witnesses[1] = [optout_element(sig1)] + add_case("empty-witness", "Witness v2 input with an empty witness", + tx, utxos, False, "empty witness") + + # 11: invalid, explicit 0x00 sighash byte on an opted-out signature. + # Complements case 5, which covers the marked form. + keys, utxos, tx = fresh_setup(2) + _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT) + _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [sig0 + bytes([0x00])] + tx.witnesses[1] = [optout_element(sig1)] + add_case("optout-explicit-default", "Opted-out input encodes " + "SIGHASH_DEFAULT explicitly as a 0x00 sighash byte", + tx, utxos, False, "explicit 0x00 sighash byte") + + # 12: valid, opted-out 64-byte signature ending in the marker byte + # 0xbc, ground via the auxiliary randomness + keys, utxos, tx = fresh_setup(2) + m0 = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT) + aux_i = 0 + while True: + aux = tagged_hash("CISA/test/aux", aux_i.to_bytes(2, "little")) + sig0 = schnorr_sign(m0, keys[0][2], aux) + if sig0[63] == MARKER_HALFAGG: + break + aux_i += 1 + _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [optout_element(sig0)] + tx.witnesses[1] = [optout_element(sig1)] + add_case("optout-sig-ends-in-marker", "Opted-out 64-byte signature " + "whose last byte equals the half-aggregation marker 0xbc", + tx, utxos, True) + + # 13: valid, half-aggregation group member carrying a signed annex + keys, utxos, tx = fresh_setup(2, key_offset=15) + annex = bytes([0x50]) + b"CISA annex test" + m0 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG, annex=annex) + m1 = sigmsg_v2(tx, utxos, 1, SIGHASH_DEFAULT, MARKER_HALFAGG) + pk0 = utxos[0].script_pubkey[2:] + pk1 = utxos[1].script_pubkey[2:] + sig0 = schnorr_sign(m0, keys[0][2], AUX_ZERO) + sig1 = schnorr_sign(m1, keys[1][2], AUX_ZERO) + aggsig_annex = halfagg.Aggregate([(pk0, m0, sig0), (pk1, m1, sig1)]) + assert halfagg.VerifyAggregate(aggsig_annex, [(pk0, m0), (pk1, m1)]) + tx.witnesses[0] = [halfagg_member(sig0[:32]), annex] + tx.witnesses[1] = [halfagg_final(aggsig_annex)] + add_case("annex-committed-valid", "Half-aggregation group whose first " + "member carries an annex that is committed in its signature " + "message", tx, utxos, True) + + # 14: invalid, annex stripped from the transaction of case 13 + keys, utxos, tx = fresh_setup(2, key_offset=15) + m0_stripped = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG) + assert not halfagg.VerifyAggregate( + aggsig_annex, [(pk0, m0_stripped), (pk1, m1)] + ) + tx.witnesses[0] = [halfagg_member(sig0[:32])] + tx.witnesses[1] = [halfagg_final(aggsig_annex)] + add_case("annex-stripped", "Annex removed by a third party from the " + "transaction of annex-committed-valid", tx, utxos, False, + "signature message committed to the annex") + + # 15: valid, witness v2 script path spend (BIP 341/342 rules unchanged) + script_seckey = test_seckey(20) + script_pk = (Scalar.from_bytes_checked(script_seckey) * G).to_bytes_xonly() + script = bytes([0x20]) + script_pk + bytes([0xAC]) # OP_CHECKSIG + tapleaf_hash = tagged_hash( + "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script)) + script + ) + internal_seckey = test_seckey(21) + d0 = Scalar.from_bytes_checked(internal_seckey) + P_int = d0 * G + internal_x = P_int.to_bytes_xonly() + t = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x + tapleaf_hash)) + Q = GE.from_bytes_xonly(internal_x) + t * G + control = bytes([0xC0 | (0 if Q.has_even_y() else 1)]) + internal_x + keys, utxos, tx = fresh_setup(2, key_offset=18) + utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q.to_bytes_xonly())) + m_script = sigmsg_tapscript(tx, utxos, 0, SIGHASH_DEFAULT, tapleaf_hash) + sig_script = schnorr_sign(m_script, script_seckey, AUX_ZERO) + assert schnorr_verify(m_script, script_pk, sig_script) + _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [sig_script, script, control] + tx.witnesses[1] = [optout_element(sig1)] + add_case("scriptpath-valid", "Witness v2 script path spend of a single " + "CHECKSIG leaf under BIP 341/342 rules, alongside an opted-out " + "key path input", tx, utxos, True) + + # 16: invalid, cross-mode messages in a full-aggregation group + # The signers run a full-aggregation session over plain BIP 341 + # messages and the result is placed in a 0xbd witness. Unlike case 9 + # there is no public fold operation for full-agg, this checks that + # verifiers derive the messages with the 0xbd marker on this path too. + keys, utxos, tx = fresh_setup(2, key_offset=22) + _, _, _, sig64_16 = sign_fullagg_group( + tx, utxos, + [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)], + msg_mode=None, + ) + pks16 = [GE.from_bytes_xonly(u.script_pubkey[2:]) for u in utxos] + consensus_msgs16 = [ + sigmsg_v2(tx, utxos, i, SIGHASH_DEFAULT, MARKER_FULLAGG) for i in range(2) + ] + R16 = GE.from_bytes_xonly(sig64_16[:32]) + s16 = Scalar.from_bytes_checked(sig64_16[32:]) + assert not fullagg.Verify(pks16, consensus_msgs16, (R16, s16)) + tx.witnesses[0] = [fullagg_member()] + tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64_16)] + add_case("cross-mode-fullagg", "Full-aggregation signature created over " + "plain BIP 341 messages, placed in a full-aggregation group", + tx, utxos, False, + "aggregate signature invalid, messages commit to the " + "aggregation mode") + + # 17: invalid, 97-byte 0xbd element. Marker 0xbd admits lengths 65 + # and 66 only, so parsing fails in pass 1 regardless of the content. + # fresh_setup(2, key_offset=3) recreates the transaction from case 2 + # deterministically, so the aggregate signature from that case + # corresponds to this tx. + _, _, _, sig64 = fullagg_base + keys, utxos, tx = fresh_setup(2, key_offset=3) + tx.witnesses[0] = [fullagg_member(SIGHASH_ALL)] + tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64 + bytes(32))] + add_case("fullagg-size-mismatch", "Full-aggregation final input carries " + "96 bytes before the marker (97-byte 0xbd element, matches no " + "defined witness structure)", tx, utxos, False, + "marker and length match no defined structure") + + # 18: valid, mixed transaction mirroring Example 4 of the BIP: two + # opted-out inputs with explicit sighash types, a half-aggregation + # group and a full-aggregation group with interleaved indices. Also + # covers a valid SIGHASH_SINGLE member with a corresponding output. + keys, utxos, tx = fresh_setup(7, key_offset=24) + tx.vout = [ + TxOut(350_000_000, v2_script_pubkey(keys[0][3])), + TxOut(349_000_000, v2_script_pubkey(keys[1][3])), + ] + _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT) + _, sig5 = sign_optout(tx, utxos, 5, keys[5][2], + SIGHASH_NONE | SIGHASH_ANYONECANPAY) + _, sigs18, aggsig18 = sign_halfagg_group( + tx, utxos, + [(1, keys[1][2], SIGHASH_SINGLE), (4, keys[4][2], SIGHASH_DEFAULT)], + ) + _, _, _, sig64_18 = sign_fullagg_group( + tx, utxos, + [(2, keys[2][2], SIGHASH_DEFAULT), (3, keys[3][2], SIGHASH_DEFAULT), + (6, keys[6][2], SIGHASH_DEFAULT)], + ) + tx.witnesses[0] = [optout_element(sig0)] + tx.witnesses[1] = [halfagg_member(sigs18[0][:32], SIGHASH_SINGLE)] + tx.witnesses[2] = [fullagg_member()] + tx.witnesses[3] = [fullagg_member()] + tx.witnesses[4] = [halfagg_final(aggsig18)] + tx.witnesses[5] = [optout_element(sig5, + SIGHASH_NONE | SIGHASH_ANYONECANPAY)] + tx.witnesses[6] = [marker_element(MARKER_FULLAGG, sig=sig64_18)] + add_case("two-groups-valid", "Mixed transaction mirroring Example 4 of " + "the BIP: two opted-out inputs, a half-aggregation group with " + "a SIGHASH_SINGLE member, and a full-aggregation group, with " + "interleaved input indices", tx, utxos, True) + + # 19: invalid, SIGHASH_SINGLE without a corresponding output. Input 1 + # signals SIGHASH_SINGLE but the transaction has only one output, so + # computing SigMsg fails per the BIP 341 failure conditions, which are + # incorporated by reference. The witness is structurally well formed + # and carries a syntactically valid signature (created over the + # SIGHASH_ALL flavored message), so the only reason for rejection is + # the missing corresponding output. + keys, utxos, tx = fresh_setup(2, key_offset=31) + _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT) + m_all = sigmsg_v1(tx, utxos, 1, SIGHASH_ALL) + sig1_19 = schnorr_sign(m_all, keys[1][2], AUX_ZERO) + tx.witnesses[0] = [optout_element(sig0)] + tx.witnesses[1] = [optout_element(sig1_19, SIGHASH_SINGLE)] + add_case("sighash-single-no-output", "Opted-out input uses " + "SIGHASH_SINGLE at input index 1 of a single-output " + "transaction", tx, utxos, False, + "SIGHASH_SINGLE input without corresponding output") + + # 20: invalid, two final inputs in one half-aggregation group. Each + # element carries a valid single-member final, so the failure is + # purely structural. Distinct from case 7, where the element after + # the final is a member. + keys, utxos, tx = fresh_setup(2, key_offset=34) + _, _, agg_a = sign_halfagg_group(tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)]) + _, _, agg_b = sign_halfagg_group(tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT)]) + tx.witnesses[0] = [halfagg_final(agg_a)] + tx.witnesses[1] = [halfagg_final(agg_b)] + add_case("halfagg-two-finals", "Two inputs each carrying a 65-byte " + "half-aggregation final element", tx, utxos, False, + "more than one final input in a group") + + # 21: invalid, two final inputs in one full-aggregation group + keys, utxos, tx = fresh_setup(2, key_offset=36) + _, _, _, sig_a = sign_fullagg_group( + tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)], nonce_offset=10) + _, _, _, sig_b = sign_fullagg_group( + tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT)], nonce_offset=11) + tx.witnesses[0] = [marker_element(MARKER_FULLAGG, sig=sig_a)] + tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig_b)] + add_case("fullagg-two-finals", "Two inputs each carrying a 65-byte " + "full-aggregation final element", tx, utxos, False, + "more than one final input in a group") + + # 22: invalid, full-aggregation members without a final input + # (full-agg analog of case 6) + keys, utxos, tx = fresh_setup(2, key_offset=38) + tx.witnesses[0] = [fullagg_member()] + tx.witnesses[1] = [fullagg_member()] + add_case("fullagg-no-final", "Full-aggregation members without an input " + "carrying the marker and the aggregate signature", tx, utxos, + False, "aggregation group has no final input") + + # 23: invalid, full-agg member after the final + # (full-agg analog of case 7) + keys, utxos, tx = fresh_setup(3, key_offset=40) + _, _, _, sig64_23 = sign_fullagg_group( + tx, utxos, + [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)], + nonce_offset=12) + tx.witnesses[0] = [fullagg_member()] + tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64_23)] + tx.witnesses[2] = [fullagg_member()] + add_case("fullagg-member-after-final", "Full-aggregation member appears " + "after the group's final input", tx, utxos, False, + "member after group final") + + # 24: valid, single-member half-aggregation group. The 65-byte + # element matches an explicit sighash opted-out signature in length + # and is distinguished by its 0xbc last byte. + keys, utxos, tx = fresh_setup(1, key_offset=43) + _, _, aggsig24 = sign_halfagg_group( + tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)]) + tx.witnesses[0] = [halfagg_final(aggsig24)] + add_case("halfagg-single-member", "Half-aggregation group with a single " + "member carrying a 64-byte aggregate in a 65-byte element", + tx, utxos, True) + + # 25: valid, single-member full-aggregation group + keys, utxos, tx = fresh_setup(1, key_offset=44) + _, _, _, sig64_25 = sign_fullagg_group( + tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)], nonce_offset=13) + tx.witnesses[0] = [marker_element(MARKER_FULLAGG, sig=sig64_25)] + add_case("fullagg-single-member", "Full-aggregation group with a single " + "member", tx, utxos, True) + + # 26: invalid, single witness element starting with the annex prefix. + # An annex requires at least two witness elements, so this parses as + # a key path element that matches no defined structure. + keys, utxos, tx = fresh_setup(2, key_offset=45) + _, sig1_26 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [bytes([0x50]) + b"CISA annex test"] + tx.witnesses[1] = [optout_element(sig1_26)] + add_case("annex-lookalike", "Single witness element starting with the " + "annex prefix 0x50", tx, utxos, False, + "matches no defined structure, a single element is never " + "an annex") + + # 27: valid, annex on the final input of a group. The annex must be + # stripped before the final element is interpreted. Complements case + # 13, which has the annex on a member input. + keys, utxos, tx = fresh_setup(2, key_offset=47) + annex27 = bytes([0x50]) + b"CISA annex test" + m0_27 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG) + m1_27 = sigmsg_v2(tx, utxos, 1, SIGHASH_DEFAULT, MARKER_HALFAGG, + annex=annex27) + pk0 = utxos[0].script_pubkey[2:] + pk1 = utxos[1].script_pubkey[2:] + sig0_27 = schnorr_sign(m0_27, keys[0][2], AUX_ZERO) + sig1_27 = schnorr_sign(m1_27, keys[1][2], AUX_ZERO) + agg27 = halfagg.Aggregate([(pk0, m0_27, sig0_27), (pk1, m1_27, sig1_27)]) + assert halfagg.VerifyAggregate(agg27, [(pk0, m0_27), (pk1, m1_27)]) + tx.witnesses[0] = [halfagg_member(sig0_27[:32])] + tx.witnesses[1] = [halfagg_final(agg27), annex27] + add_case("annex-on-final", "Half-aggregation group whose final input " + "carries an annex that is committed in its signature message", + tx, utxos, True) + + # 28: invalid, undefined sighash value. Cases 5 and 11 cover the + # explicit 0x00 encoding rule, this covers a value outside the + # defined set. The signature covers the message that hashes 0x04, + # so only the sighash validation fails. + keys, utxos, tx = fresh_setup(2, key_offset=49) + m0_28 = sigmsg_v1(tx, utxos, 0, 0x04) + sig0_28 = schnorr_sign(m0_28, keys[0][2], AUX_ZERO) + _, sig1_28 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [sig0_28 + bytes([0x04])] + tx.witnesses[1] = [optout_element(sig1_28)] + add_case("sighash-value-undefined", "Opted-out input with the undefined " + "sighash value 0x04", tx, utxos, False, + "undefined sighash type") + + # 29: invalid, 33-byte element ending in 0xbc. It parses as a + # half-aggregation member whose sighash byte is the marker value, + # which is not a valid sighash type. + keys, utxos, tx = fresh_setup(2, key_offset=51) + _, sig0_29 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT) + _, _, agg29 = sign_halfagg_group( + tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT)]) + tx.witnesses[0] = [optout_element(sig0_29)] + tx.witnesses[1] = [agg29[:32] + bytes([MARKER_HALFAGG])] + add_case("member-sighash-is-marker", "33-byte element ending in the " + "marker 0xbc, a half-aggregation member with an invalid " + "sighash byte", tx, utxos, False, "undefined sighash type") + + # 30: valid, witness v2 output whose witness program is not 32 bytes. + # Such outputs remain unencumbered by the BIP, so the witness content + # is unconstrained, even an undefined marker byte. + keys, utxos, tx = fresh_setup(2, key_offset=53) + program33 = test_garbage(b"33-byte program", 33) + utxos[0] = TxOut(100_000_000, bytes([0x52, 0x21]) + program33) + _, sig1_30 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [bytes([0xBE])] + tx.witnesses[1] = [optout_element(sig1_30)] + add_case("program-not-32-bytes", "Witness v2 output with a 33-byte " + "witness program spent with an arbitrary witness", tx, utxos, + True) + + # 31: invalid, opted-out witness program is not a valid x coordinate. + # BIP 340 verification fails at lift_x. + keys, utxos, tx = fresh_setup(2, key_offset=55) + utxos[0] = TxOut(100_000_000, + bytes([0x52, 0x20]) + test_offcurve_x(b"optout")) + _, sig1_31 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [optout_element(test_garbage(b"offcurve sig", 64))] + tx.witnesses[1] = [optout_element(sig1_31)] + add_case("program-offcurve-optout", "Opted-out input whose witness " + "program is not a valid x-only public key", tx, utxos, False, + "witness program is not a valid x-only public key") + + # 32: invalid, group member witness program is not a valid x + # coordinate. VerifyAggregate fails at lift_x of the first pubkey, so + # the aggregate content is irrelevant. + keys, utxos, tx = fresh_setup(2, key_offset=57) + utxos[0] = TxOut(100_000_000, + bytes([0x52, 0x20]) + test_offcurve_x(b"group")) + m1_32 = sigmsg_v2(tx, utxos, 1, SIGHASH_DEFAULT, MARKER_HALFAGG) + sig1_32 = schnorr_sign(m1_32, keys[1][2], AUX_ZERO) + agg32 = test_garbage(b"offcurve r0", 32) + sig1_32 + assert not halfagg.VerifyAggregate(agg32, [ + (utxos[0].script_pubkey[2:], + sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)), + (utxos[1].script_pubkey[2:], m1_32), + ]) + tx.witnesses[0] = [halfagg_member(agg32[:32])] + tx.witnesses[1] = [halfagg_final(agg32)] + add_case("program-offcurve-in-group", "Half-aggregation group member " + "whose witness program is not a valid x-only public key", + tx, utxos, False, + "witness program is not a valid x-only public key") + + # 33: valid, script path spend with an unknown leaf version (0xc2). + # Unknown leaf versions succeed unconditionally under BIP 341, + # preserving the upgrade hook in witness v2. + keys, utxos, tx = fresh_setup(2, key_offset=59) + internal_seckey33 = test_seckey(200) + internal_x33 = (Scalar.from_bytes_checked(internal_seckey33) * G).to_bytes_xonly() + script33 = bytes([0x51]) + leaf33 = tagged_hash( + "TapLeaf", bytes([0xC2]) + ser_compact_size(len(script33)) + script33) + t33 = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x33 + leaf33)) + Q33 = GE.from_bytes_xonly(internal_x33) + t33 * G + control33 = bytes([0xC2 | (0 if Q33.has_even_y() else 1)]) + internal_x33 + utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q33.to_bytes_xonly())) + _, sig1_33 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [script33, control33] + tx.witnesses[1] = [optout_element(sig1_33)] + add_case("scriptpath-unknown-leaf-version", "Witness v2 script path " + "spend with unknown leaf version 0xc2, which succeeds " + "unconditionally per BIP 341", tx, utxos, True) + + # 34: valid, script path leaf containing an OP_SUCCESS opcode. The + # script byte 0xbc is OP_SUCCESS188 in tapscript and has no marker + # meaning inside a script. + keys, utxos, tx = fresh_setup(2, key_offset=61) + internal_seckey34 = test_seckey(201) + internal_x34 = (Scalar.from_bytes_checked(internal_seckey34) * G).to_bytes_xonly() + script34 = bytes([MARKER_HALFAGG]) + leaf34 = tagged_hash( + "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script34)) + script34) + t34 = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x34 + leaf34)) + Q34 = GE.from_bytes_xonly(internal_x34) + t34 * G + control34 = bytes([0xC0 | (0 if Q34.has_even_y() else 1)]) + internal_x34 + utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q34.to_bytes_xonly())) + _, sig1_34 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [script34, control34] + tx.witnesses[1] = [optout_element(sig1_34)] + add_case("scriptpath-op-success", "Witness v2 script path spend whose " + "leaf script is OP_SUCCESS188 (byte 0xbc), which succeeds " + "unconditionally per BIP 342", tx, utxos, True) + + # 35: valid, mixed witness v1 and v2 transaction mirroring Example 3 + # of the BIP. Input 0 spends a taproot output with an unchanged + # BIP 341 key path signature (epoch 0x00, no marker). + keys, utxos, tx = fresh_setup(3, key_offset=63) + utxos[0] = TxOut(100_000_000, bytes([0x51, 0x20]) + keys[0][3]) + m0_35 = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT) + sig0_35 = schnorr_sign(m0_35, keys[0][2], AUX_ZERO) + _, sigs35, agg35 = sign_halfagg_group( + tx, utxos, + [(1, keys[1][2], SIGHASH_DEFAULT), (2, keys[2][2], SIGHASH_DEFAULT)]) + tx.witnesses[0] = [sig0_35] + tx.witnesses[1] = [halfagg_member(sigs35[0][:32])] + tx.witnesses[2] = [halfagg_final(agg35)] + add_case("v1-v2-mixed", "Witness v1 key path input alongside a " + "two-member witness v2 half-aggregation group, mirroring " + "Example 3 of the BIP", tx, utxos, True) + + # 36: invalid, explicit sighash byte stripped by a third party. Input + # 0 signed with explicit SIGHASH_ALL, the witness is malleated to the + # 32-byte form, so the verifier derives the SIGHASH_DEFAULT flavored + # message. Complements case 14, which strips the annex. + keys, utxos, tx = fresh_setup(2, key_offset=66) + msgs36, sigs36, agg36 = sign_halfagg_group( + tx, utxos, + [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_DEFAULT)]) + m0_default = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG) + assert not halfagg.VerifyAggregate(agg36, [ + (utxos[0].script_pubkey[2:], m0_default), + (utxos[1].script_pubkey[2:], msgs36[1]), + ]) + tx.witnesses[0] = [halfagg_member(sigs36[0][:32])] + tx.witnesses[1] = [halfagg_final(agg36)] + add_case("sighash-byte-stripped", "Explicit SIGHASH_ALL byte removed " + "from a group member by a third party", tx, utxos, False, + "signature message committed to the sighash type") + + # 37: invalid, single empty witness element. It parses as a + # full-aggregation member and the group has no final input. Distinct + # from case 10, where the witness stack itself is empty. + keys, utxos, tx = fresh_setup(2, key_offset=68) + _, sig1_37 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [b""] + tx.witnesses[1] = [optout_element(sig1_37)] + add_case("empty-element-no-final", "Witness v2 input whose only witness " + "element is empty, a full-aggregation member without a final " + "input", tx, utxos, False, + "aggregation group has no final input") + + # 38: invalid, SIGHASH_SINGLE group member without a corresponding + # output. Complements case 19, which covers the opted-out path. The + # witness is structurally well formed (66-byte final element) and + # the signature bytes are created over the SIGHASH_ALL flavored + # message, so the only reason for rejection is the missing output. + keys, utxos, tx = fresh_setup(2, key_offset=70) + pk0 = utxos[0].script_pubkey[2:] + pk1 = utxos[1].script_pubkey[2:] + m0_38 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG) + m1_38 = sigmsg_v2(tx, utxos, 1, SIGHASH_ALL, MARKER_HALFAGG) + sig0_38 = schnorr_sign(m0_38, keys[0][2], AUX_ZERO) + sig1_38 = schnorr_sign(m1_38, keys[1][2], AUX_ZERO) + agg38 = halfagg.Aggregate([(pk0, m0_38, sig0_38), (pk1, m1_38, sig1_38)]) + tx.witnesses[0] = [halfagg_member(sig0_38[:32])] + tx.witnesses[1] = [halfagg_final(agg38, SIGHASH_SINGLE)] + add_case("sighash-single-no-output-group", "Half-aggregation group " + "member uses SIGHASH_SINGLE at input index 1 of a " + "single-output transaction", tx, utxos, False, + "SIGHASH_SINGLE input without corresponding output") + + # 39: invalid, two witness elements where the last is not an annex. + # With two elements and no annex prefix this is a script path spend, + # and the 1-byte last element is not a valid control block. + keys, utxos, tx = fresh_setup(2, key_offset=72) + m0_39 = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT) + sig0_39 = schnorr_sign(m0_39, keys[0][2], AUX_ZERO) + _, sig1_39 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [sig0_39, bytes([0x60])] + tx.witnesses[1] = [optout_element(sig1_39)] + add_case("two-elements-no-annex", "Keypath-looking element followed by " + "a second element that is not an annex, making this a script " + "path spend with an invalid control block", tx, utxos, False, + "invalid control block size") + + # 40: invalid, half-aggregation flavored signature placed as a bare + # 64-byte opted-out element + keys, utxos, tx = fresh_setup(2, key_offset=74) + m0_agg = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG) + sig0_40 = schnorr_sign(m0_agg, keys[0][2], AUX_ZERO) + m0_plain = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT) + assert not schnorr_verify(m0_plain, utxos[0].script_pubkey[2:], sig0_40) + _, sig1_40 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [optout_element(sig0_40)] + tx.witnesses[1] = [optout_element(sig1_40)] + add_case("agg-mode-sig-as-optout", "Signature created over the " + "half-aggregation flavored message used as a bare opted-out " + "signature", tx, utxos, False, + "signature invalid, message commits to the aggregation mode") + + # 41: valid, 8-member half-aggregation group, exercising the nonce + # share assembly across many inputs + keys, utxos, tx = fresh_setup(8, key_offset=76) + members41 = [(i, keys[i][2], SIGHASH_DEFAULT) for i in range(8)] + _, sigs41, agg41 = sign_halfagg_group(tx, utxos, members41) + for i in range(7): + tx.witnesses[i] = [halfagg_member(sigs41[i][:32])] + tx.witnesses[7] = [halfagg_final(agg41)] + add_case("halfagg-large-group", "8-member half-aggregation group", + tx, utxos, True) + + # 42: valid, script path spend whose first stack element is a 1-byte + # 0xbc marker lookalike. With three witness elements this is a script + # path spend, so marker interpretation does not apply. The leaf + # script drops the element and pushes true. + keys, utxos, tx = fresh_setup(2, key_offset=84) + internal_seckey42 = test_seckey(202) + internal_x42 = (Scalar.from_bytes_checked(internal_seckey42) * G).to_bytes_xonly() + script42 = bytes([0x75, 0x51]) # OP_DROP OP_1 + leaf42 = tagged_hash( + "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script42)) + script42) + t42 = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x42 + leaf42)) + Q42 = GE.from_bytes_xonly(internal_x42) + t42 * G + control42 = bytes([0xC0 | (0 if Q42.has_even_y() else 1)]) + internal_x42 + utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q42.to_bytes_xonly())) + _, sig1_42 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [bytes([MARKER_HALFAGG]), script42, control42] + tx.witnesses[1] = [optout_element(sig1_42)] + add_case("scriptpath-marker-lookalike", "Script path spend whose first " + "stack element is a 1-byte 0xbc marker lookalike, which has " + "no marker meaning outside key path spends", tx, utxos, True) + + # 43: valid, both group members spend outputs with the same witness + # program (address reuse). The messages differ by input index and + # neither scheme deduplicates keys. + keys, utxos, tx = fresh_setup(4, key_offset=86) + utxos[1] = TxOut(100_000_000, v2_script_pubkey(keys[0][3])) + utxos[3] = TxOut(100_000_000, v2_script_pubkey(keys[2][3])) + _, sigs43, agg43 = sign_halfagg_group( + tx, utxos, + [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[0][2], SIGHASH_DEFAULT)]) + _, _, _, sig64_43 = sign_fullagg_group( + tx, utxos, + [(2, keys[2][2], SIGHASH_DEFAULT), (3, keys[2][2], SIGHASH_DEFAULT)], + nonce_offset=20) + tx.witnesses[0] = [halfagg_member(sigs43[0][:32])] + tx.witnesses[1] = [halfagg_final(agg43)] + tx.witnesses[2] = [fullagg_member()] + tx.witnesses[3] = [marker_element(MARKER_FULLAGG, sig=sig64_43)] + add_case("duplicate-key-groups", "Half-aggregation and full-aggregation " + "groups whose two members each spend outputs with the same " + "witness program (address reuse)", tx, utxos, True) + + # 44: invalid, ANYONECANPAY signature for the same output key created + # as if spending the v1 scriptPubKey, replayed on the witness v2 + # input. Fails because the message commits to the spent scriptPubKey. + keys, utxos, tx = fresh_setup(2, key_offset=90) + utxos_v1 = list(utxos) + utxos_v1[0] = TxOut(utxos[0].amount, bytes([0x51, 0x20]) + keys[0][3]) + ht44 = SIGHASH_ALL | SIGHASH_ANYONECANPAY + m0_v1spk = sigmsg_v1(tx, utxos_v1, 0, ht44) + sig0_44 = schnorr_sign(m0_v1spk, keys[0][2], AUX_ZERO) + m0_v2spk = sigmsg_v1(tx, utxos, 0, ht44) + assert not schnorr_verify(m0_v2spk, keys[0][3], sig0_44) + _, sig1_44 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [optout_element(sig0_44, ht44)] + tx.witnesses[1] = [optout_element(sig1_44)] + add_case("v1-replay", "BIP 341 key path signature created for a " + "witness v1 output with the same output key, replayed on a " + "witness v2 input", tx, utxos, False, + "signature message commits to the spent scriptPubKey") + + # 45: invalid, undefined sighash value on a 1-byte full-aggregation + # member, complementing case 28 for the member forms. The aggregate + # covers the matching messages, so only the sighash validation fails. + keys, utxos, tx = fresh_setup(3, key_offset=92) + _, sig0_45 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT) + _, _, _, sig64_45 = sign_fullagg_group( + tx, utxos, [(1, keys[1][2], 0x04), (2, keys[2][2], SIGHASH_DEFAULT)], + nonce_offset=21) + tx.witnesses[0] = [optout_element(sig0_45)] + tx.witnesses[1] = [fullagg_member(0x04)] + tx.witnesses[2] = [marker_element(MARKER_FULLAGG, sig=sig64_45)] + add_case("member-sighash-undefined", "Full-aggregation member with the " + "undefined sighash value 0x04", tx, utxos, False, + "undefined sighash type") + + # 46: invalid, 97-byte 0xbc element carrying the whole aggregate + # signature on the final input, the encoding of an earlier revision + # of this BIP. Half-agg analog of case 17. + keys, utxos, tx = fresh_setup(2, key_offset=95) + _, sigs46, agg46 = sign_halfagg_group( + tx, utxos, + [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)]) + tx.witnesses[0] = [halfagg_member(sigs46[0][:32])] + tx.witnesses[1] = [marker_element(MARKER_HALFAGG, sig=agg46)] + add_case("halfagg-final-old-format", "97-byte 0xbc element carrying the " + "whole aggregate signature, the final input encoding of an " + "earlier revision", tx, utxos, False, + "marker and length match no defined structure") + + # 47: valid, half-aggregation member with SIGHASH_ALL|ANYONECANPAY, + # covering the per-input commitment branch of SigMsg in an + # aggregation flavored message + keys, utxos, tx = fresh_setup(2, key_offset=97) + ht47 = SIGHASH_ALL | SIGHASH_ANYONECANPAY + _, sigs47, agg47 = sign_halfagg_group( + tx, utxos, [(0, keys[0][2], ht47), (1, keys[1][2], SIGHASH_DEFAULT)] + ) + tx.witnesses[0] = [halfagg_member(sigs47[0][:32], ht47)] + tx.witnesses[1] = [halfagg_final(agg47)] + add_case("halfagg-acp-member", "Half-aggregation group with a " + "SIGHASH_ALL|SIGHASH_ANYONECANPAY member", tx, utxos, True) + + # 48: invalid, marker of the full-aggregation final from case 25 + # flipped to 0xbc by a third party, which parses as a half-aggregation + # final of the correct size. Fails because the message commits to the + # marker. fresh_setup(1, key_offset=44) recreates the case 25 tx. + keys, utxos, tx = fresh_setup(1, key_offset=44) + m0_48 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG) + assert not halfagg.VerifyAggregate( + sig64_25, [(utxos[0].script_pubkey[2:], m0_48)]) + tx.witnesses[0] = [marker_element(MARKER_HALFAGG, sig=sig64_25)] + add_case("marker-swapped-fullagg", "Full-aggregation final of a " + "single-member group mutated to carry the half-aggregation " + "marker", tx, utxos, False, + "aggregate signature invalid, messages commit to the " + "aggregation mode") + + # 49: valid, annex on an empty full-aggregation member element. + # Complements cases 13 and 27 for the empty element form. + keys, utxos, tx = fresh_setup(2, key_offset=99) + annex49 = bytes([0x50]) + b"CISA annex test" + _, _, _, sig64_49 = sign_fullagg_group( + tx, utxos, + [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)], + nonce_offset=22, annexes={0: annex49}) + tx.witnesses[0] = [fullagg_member(), annex49] + tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64_49)] + add_case("annex-on-empty-member", "Full-aggregation member carrying an " + "annex on an empty witness element, committed in its signature " + "message", tx, utxos, True) + + # 50: invalid, nonce shares swapped between the two inputs by a third + # party. The randomizers of the aggregate commit to the shares in + # input order, so verification fails. + keys, utxos, tx = fresh_setup(2, key_offset=101) + _, sigs50, agg50 = sign_halfagg_group( + tx, utxos, + [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)]) + swapped = sigs50[1][:32] + sigs50[0][:32] + agg50[-32:] + msgs50 = [(utxos[i].script_pubkey[2:], + sigmsg_v2(tx, utxos, i, SIGHASH_DEFAULT, MARKER_HALFAGG)) + for i in range(2)] + assert not halfagg.VerifyAggregate(swapped, msgs50) + tx.witnesses[0] = [halfagg_member(sigs50[1][:32])] + tx.witnesses[1] = [halfagg_final(swapped)] + add_case("nonce-shares-swapped", "Nonce shares of the two " + "half-aggregation inputs swapped by a third party", tx, utxos, + False, "aggregate signature invalid, the randomizers commit " + "to the shares in input order") + + # 51: invalid, 66-byte element ending in a valid sighash byte. + # 66-byte elements must end in a marker, there is no 66-byte + # opted-out form. + keys, utxos, tx = fresh_setup(2, key_offset=103) + _, sig0_51 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_ALL) + _, sig1_51 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [sig0_51 + bytes([SIGHASH_ALL, SIGHASH_ALL])] + tx.witnesses[1] = [optout_element(sig1_51)] + add_case("optout-too-long", "66-byte element ending in a valid sighash " + "byte, one byte above the opted-out maximum", tx, utxos, False, + "marker and length match no defined structure") + + # 52: invalid, 1-byte element containing only the marker value. It + # parses as a full-aggregation member with an invalid sighash byte. + # In an earlier revision this was a valid placeholder form. + keys, utxos, tx = fresh_setup(2, key_offset=105) + _, sig1_52 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [bytes([MARKER_HALFAGG])] + tx.witnesses[1] = [optout_element(sig1_52)] + add_case("member-marker-only", "1-byte element containing only the " + "marker value 0xbc, a full-aggregation member with an invalid " + "sighash byte", tx, utxos, False, "undefined sighash type") + + # 53: invalid, marker of the half-aggregation final from case 24 + # flipped to 0xbd by a third party, the mirror of case 48. + # fresh_setup(1, key_offset=43) recreates the case 24 tx. + keys, utxos, tx = fresh_setup(1, key_offset=43) + m0_53 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_FULLAGG) + R53 = GE.from_bytes_xonly(aggsig24[:32]) + s53 = Scalar.from_bytes_checked(aggsig24[32:]) + assert not fullagg.Verify( + [GE.from_bytes_xonly(utxos[0].script_pubkey[2:])], [m0_53], + (R53, s53)) + tx.witnesses[0] = [marker_element(MARKER_FULLAGG, sig=aggsig24)] + add_case("marker-swapped-halfagg", "Half-aggregation final of a " + "single-member group mutated to carry the full-aggregation " + "marker", tx, utxos, False, + "aggregate signature invalid, messages commit to the " + "aggregation mode") + + # 54: valid, witness v2 program wrapped in P2SH, the P2SH analog of + # case 30. Such outputs remain unencumbered by the BIP, so the + # witness content is unconstrained. + keys, utxos, tx = fresh_setup(2, key_offset=107) + redeem54 = bytes([0x52, 0x20]) + test_garbage(b"p2sh program") + h160 = hashlib.new("ripemd160", sha256(redeem54)).digest() + utxos[0] = TxOut(100_000_000, bytes([0xA9, 0x14]) + h160 + bytes([0x87])) + tx.vin[0].script_sig = bytes([len(redeem54)]) + redeem54 + _, sig1_54 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT) + tx.witnesses[0] = [bytes([0xBE])] + tx.witnesses[1] = [optout_element(sig1_54)] + add_case("program-p2sh-wrapped", "P2SH-wrapped witness v2 program " + "spent with an arbitrary witness", tx, utxos, True) + + # 55: valid, full-aggregation group using SIGHASH_NONE, + # SIGHASH_SINGLE and the three ANYONECANPAY variants. Every input + # has an output at its index, as SIGHASH_SINGLE requires. + keys, utxos, tx = fresh_setup(5, key_offset=109) + tx.vout = [TxOut(99_000_000, v2_script_pubkey(k[3])) for k in keys] + ht55 = [SIGHASH_NONE, SIGHASH_SINGLE, + SIGHASH_ALL | SIGHASH_ANYONECANPAY, + SIGHASH_NONE | SIGHASH_ANYONECANPAY, + SIGHASH_SINGLE | SIGHASH_ANYONECANPAY] + _, _, _, sig64_55 = sign_fullagg_group( + tx, utxos, [(i, keys[i][2], ht) for i, ht in enumerate(ht55)], + nonce_offset=23) + for i in range(4): + tx.witnesses[i] = [fullagg_member(ht55[i])] + tx.witnesses[4] = [marker_element(MARKER_FULLAGG, ht55[4], sig64_55)] + add_case("fullagg-sighash-types", "Full-aggregation group using " + "SIGHASH_NONE, SIGHASH_SINGLE and the three ANYONECANPAY " + "variants", tx, utxos, True) + + # 56: valid, half-aggregation group using SIGHASH_NONE, + # SIGHASH_NONE|ANYONECANPAY and SIGHASH_SINGLE|ANYONECANPAY. Every + # input has an output at its index, as SIGHASH_SINGLE requires. + keys, utxos, tx = fresh_setup(3, key_offset=114) + tx.vout = [TxOut(99_000_000, v2_script_pubkey(k[3])) for k in keys] + ht56 = [SIGHASH_NONE, SIGHASH_NONE | SIGHASH_ANYONECANPAY, + SIGHASH_SINGLE | SIGHASH_ANYONECANPAY] + _, sigs56, agg56 = sign_halfagg_group( + tx, utxos, [(i, keys[i][2], ht) for i, ht in enumerate(ht56)]) + tx.witnesses[0] = [halfagg_member(sigs56[0][:32], ht56[0])] + tx.witnesses[1] = [halfagg_member(sigs56[1][:32], ht56[1])] + tx.witnesses[2] = [halfagg_final(agg56, ht56[2])] + add_case("halfagg-sighash-types", "Half-aggregation group using " + "SIGHASH_NONE, SIGHASH_NONE|ANYONECANPAY and " + "SIGHASH_SINGLE|ANYONECANPAY", tx, utxos, True) + + return {"testCases": cases} + + +def main(): + out_dir = Path(__file__).parent + wallet = make_wallet_vectors() + consensus = make_consensus_vectors() + with open(out_dir / "wallet-test-vectors.json", "w") as f: + json.dump(wallet, f, indent=2) + f.write("\n") + with open(out_dir / "consensus-test-vectors.json", "w") as f: + json.dump(consensus, f, indent=2) + f.write("\n") + print(f"wrote {out_dir / 'wallet-test-vectors.json'}") + print(f"wrote {out_dir / 'consensus-test-vectors.json'}") + + +if __name__ == "__main__": + main() diff --git a/bip-0460/wallet-test-vectors.json b/bip-0460/wallet-test-vectors.json new file mode 100644 index 00000000..9fdb49d2 --- /dev/null +++ b/bip-0460/wallet-test-vectors.json @@ -0,0 +1,222 @@ +{ + "scriptPubKey": [ + { + "given": { + "internalPubkey": "34b703e82bfdedfbab012da7a34767456c3f85524171663df7c0aaf227276901" + }, + "intermediary": { + "tweak": "4821522480fda0d8eeab11f09a642cae24605302c3ccda3f590e323f81d6fc0b", + "tweakedPubkey": "4049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b" + }, + "expected": { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "address": "bc1zgpyuugjdfdjq06w8se8g3kqzpxttavzxv0x3t94lflu2kv6mc4as88u8yc" + } + }, + { + "given": { + "internalPubkey": "cca0578cd53156e37b6e87c90b2d03cb38b046587a7c4a9a2986e24d0c85c120" + }, + "intermediary": { + "tweak": "d18eb46c3f1105be40607ff7c064a3af23cb7cce36938f7cf73dbfd2e694a950", + "tweakedPubkey": "cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5" + }, + "expected": { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "address": "bc1zejf5zh4d6tknfhrx3v69aaya6jfw4t6uq43ystfe8ytev6ndhl2sx2w44g" + } + } + ], + "keyPathSpending": [ + { + "description": "Opted-out input with SIGHASH_ALL alongside a two-member half-aggregation group with SIGHASH_DEFAULT", + "given": { + "rawUnsignedTx": "0200000003375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff8e89080fe122cee9ffa6c0b2128cc14be4ca148c2629d0040f6037cfd0f816190000000000ffffffff01c060d211000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b00000000", + "utxosSpent": [ + { + "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b", + "amountSats": 100000000 + }, + { + "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5", + "amountSats": 101000000 + }, + { + "scriptPubKey": "52208877c408836c8fac26214cd6ce52200ef5c44f8466b08d889cc671b7fa7dbcbd", + "amountSats": 102000000 + } + ] + }, + "inputSpending": [ + { + "given": { + "txinIndex": 0, + "internalPrivkey": "50dbc446357ea19a9f032c65541a3d69d7fce0f909c67671ab92f0fdf75bc75b", + "aggMode": null, + "hashType": 1 + }, + "intermediary": { + "internalPubkey": "34b703e82bfdedfbab012da7a34767456c3f85524171663df7c0aaf227276901", + "tweak": "4821522480fda0d8eeab11f09a642cae24605302c3ccda3f590e323f81d6fc0b", + "tweakedPrivkey": "98fd166ab67c42738dae3e55ee7e6a17fc5d33fbcd9350b104a1233d7932c366", + "sigHash": "d69ac779928b23970adb2b5db967f32353d9f8025b721b146f063a65015e0809" + }, + "expected": { + "witness": [ + "86a207d61052859ed25d045739ff69f6c94e246c7e95c0bd2dbf951cb75f0ee55e890397180835f8d5aeb8eabef4c9e234b13aa87fe38c96f25001f3b1a0631d01" + ] + } + }, + { + "given": { + "txinIndex": 1, + "internalPrivkey": "26cc4c0d15b25be1e2137c638a99c9dbce9cfe8b74d2f1612731d9e620648870", + "aggMode": "0xbc", + "hashType": 0 + }, + "intermediary": { + "internalPubkey": "cca0578cd53156e37b6e87c90b2d03cb38b046587a7c4a9a2986e24d0c85c120", + "tweak": "d18eb46c3f1105be40607ff7c064a3af23cb7cce36938f7cf73dbfd2e694a950", + "tweakedPrivkey": "f85b007954c361a02273fc5b4afe6d8af2687b59ab6680de1e6f99b906f931c0", + "sigHash": "b4790a58d8405ea70b8758143fd245301d725b23af4a60a2d2393686b79122af" + }, + "expected": { + "witness": [ + "5dc80989a7bcfb1fce2602935d5b70052b7eb030c50f4a9f08b49c08cb20ef3f" + ] + } + }, + { + "given": { + "txinIndex": 2, + "internalPrivkey": "213ac0b0d8b50089762f10ee2851872255c673e87da343375d89060cbec74e4a", + "aggMode": "0xbc", + "hashType": 0 + }, + "intermediary": { + "internalPubkey": "49d40eb515a74c614f7b231d3b2957b5dd4267f34b0c99f3da86116d1974670c", + "tweak": "88e8cdaa41ee11c3a85fcb9b1321fcd82d4c79ba143265d6df49ed76127071ca", + "tweakedPrivkey": "67ae0cf96939113a3230baacead075b5d78605d1968f229f81c0e76953a92380", + "sigHash": "d8562e8cf18da05da50f2bc3f00fc8b93585bcc3c07e398b85a68b068c15247c" + }, + "expected": { + "witness": [ + "9e0f4cac3b04d5360ca75e857091040adbc8e35d7e72d6ba1e4d4d5f407018ebe603d806099e372dd2a69aa2a10d23361cf711fcdd5a7ca1b79456cf318c95adbc" + ] + } + } + ], + "auxiliary": { + "aggregateSignature": "5dc80989a7bcfb1fce2602935d5b70052b7eb030c50f4a9f08b49c08cb20ef3f9e0f4cac3b04d5360ca75e857091040adbc8e35d7e72d6ba1e4d4d5f407018ebe603d806099e372dd2a69aa2a10d23361cf711fcdd5a7ca1b79456cf318c95ad" + }, + "expected": { + "rawSignedTx": "02000000000103375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff8e89080fe122cee9ffa6c0b2128cc14be4ca148c2629d0040f6037cfd0f816190000000000ffffffff01c060d211000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b014186a207d61052859ed25d045739ff69f6c94e246c7e95c0bd2dbf951cb75f0ee55e890397180835f8d5aeb8eabef4c9e234b13aa87fe38c96f25001f3b1a0631d0101205dc80989a7bcfb1fce2602935d5b70052b7eb030c50f4a9f08b49c08cb20ef3f01419e0f4cac3b04d5360ca75e857091040adbc8e35d7e72d6ba1e4d4d5f407018ebe603d806099e372dd2a69aa2a10d23361cf711fcdd5a7ca1b79456cf318c95adbc00000000" + } + }, + { + "description": "Two-member full-aggregation group with SIGHASH_ALL (using deterministic nonces)", + "given": { + "rawUnsignedTx": "020000000254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0100000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0100000000ffffffff01c0cb1707000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e400000000", + "utxosSpent": [ + { + "scriptPubKey": "52208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e4", + "amountSats": 50000000 + }, + { + "scriptPubKey": "522018b6491469cc78b764b01669b0a5a4e892f57e8c1b20b89bc1ca6dce3e881b51", + "amountSats": 70000000 + } + ] + }, + "inputSpending": [ + { + "given": { + "txinIndex": 0, + "internalPrivkey": "edc07892ebcc0812db6aea0fbc967eed825fedecf70db83d4c69fbe574b97361", + "aggMode": "0xbd", + "hashType": 1 + }, + "intermediary": { + "internalPubkey": "020be368e697e135d54cd88e86b42c0b5e3e72d4b0c77632a8a4d0441203ded5", + "tweak": "22b1442d7532c6cdbe4d9854a90b8f7a5820c559af2ca6f7d375e6fc3bfd8a09", + "tweakedPrivkey": "1071bcc060fecee099b8826465a20e691fd1d65ff6f1bef9600d8454e080bc29", + "sigHash": "9339267f5f6715d1b7e1b26bd69e13689b3872be5fa0c50a9d90daf9f2ae46cc" + }, + "expected": { + "witness": [ + "01" + ] + } + }, + { + "given": { + "txinIndex": 1, + "internalPrivkey": "80f4d8f499868a546ca66497352d4df0aa1c7e99cd83faeba3eeb11ecafec708", + "aggMode": "0xbd", + "hashType": 1 + }, + "intermediary": { + "internalPubkey": "0fef9c578d084fb5f7c8fe48a570dc644609cc012a356fdd0c056f674f9455c0", + "tweak": "85fb96a1a8a6c3a93ebfaf308aecc9837eceb6cfda6eb735cf8586e989a87563", + "tweakedPrivkey": "0506bdad0f203954d2194a9955bf7b92d4b238360ceabc4a2b96d5cabea9ae5b", + "sigHash": "d2982e6665e1e964ecefa2a747b19f17ad46d6765e284d639c293647c9349857" + }, + "expected": { + "witness": [ + "4be941b64750c3c7746300107ddcb53de5a1a4e106938eed846bad8493d1e95272717f49232d9639b988cf0a135df878463dd5680bfc71c407d11cc09a42677e01bd" + ] + } + } + ], + "auxiliary": { + "secnonces": [ + "87c33dcedc7db5994d68278a81a4693ee961d08ef7e3fdeab611ab8061e92dd4517ac39af981926ed1124224dfe721c6dc0769a8ea24d2e2fc2636c3b1e9ca15", + "3c4b7832dd37bbdb955ebf900769d133d55161e5c6ad9e09c2efa4ace1ba2e153d007745e9f74e6b8a47651a672111b07589261401674263a40e286340bcefea" + ], + "pubnonces": [ + "021be5111aa027a4b7368d88cb0f5419f7b530e17e41af6fe7a611a03abc9bab63020e72955a3c53f163a1373ac5233ad30ff8bb4ef69dad424d91529c0ef6329ac6", + "0367b7d091e6b58f7e94e9228393bc6b777e9fbe0186e9fce56248c9177c96f65e03592137dea3431dbb0fbe1287c35f8e44a30d68e62486969d21e90d2b4c68f05e" + ], + "aggregateSignature": "4be941b64750c3c7746300107ddcb53de5a1a4e106938eed846bad8493d1e95272717f49232d9639b988cf0a135df878463dd5680bfc71c407d11cc09a42677e" + }, + "expected": { + "rawSignedTx": "0200000000010254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0100000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0100000000ffffffff01c0cb1707000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e401010101424be941b64750c3c7746300107ddcb53de5a1a4e106938eed846bad8493d1e95272717f49232d9639b988cf0a135df878463dd5680bfc71c407d11cc09a42677e01bd00000000" + } + } + ], + "scriptPathSpending": [ + { + "description": "Script path spend of a witness v2 output with a single CHECKSIG leaf, following BIP 341/342 unchanged", + "given": { + "rawUnsignedTx": "02000000019d159d40bef848f021458aee62eecb1006f6e987d41b8af985dcb13cf97b47d60000000000ffffffff01c09ee605000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b00000000", + "utxosSpent": [ + { + "scriptPubKey": "5220e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b", + "amountSats": 100000000 + } + ], + "internalPubkey": "39920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da4", + "script": "2038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac", + "leafVersion": "0xc0", + "hashType": 0 + }, + "intermediary": { + "leafHash": "d888fa5463776e32e8b0fddf14df8b3862673078395cbc592c10912056af7c52", + "tweak": "543da6eae6544c2af0aa1c684f67bf908059153e077714caa4af34da3bd72ae6", + "tweakedPubkey": "e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b", + "controlBlock": "c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da4", + "sigHash": "ea23ae9afeeb7f6e5e6aa6ca278eee5071aa9f20ca843a590b28f0faf9df058c" + }, + "expected": { + "scriptPubKey": "5220e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b", + "address": "bc1zaps9lu27w4qe92wkcpfedxhfxkfjeqkw4m4qlmv6z5hsc66tgf9sg52494", + "witness": [ + "3f748f6e85b7064aa161a2e35ed5d17f540a2de4975c690739a04af70adf372b6daa1b3a27d553c38e12547289803aeb2d726187cdf6faec419e5cd864391460", + "2038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac", + "c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da4" + ], + "rawSignedTx": "020000000001019d159d40bef848f021458aee62eecb1006f6e987d41b8af985dcb13cf97b47d60000000000ffffffff01c09ee605000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b03403f748f6e85b7064aa161a2e35ed5d17f540a2de4975c690739a04af70adf372b6daa1b3a27d553c38e12547289803aeb2d726187cdf6faec419e5cd864391460222038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac21c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da400000000" + } + } + ] +}