fix(bip137): add checks for recid on sign message

This commit add checks for signing message UI using recid following spec
from BIP137.

Author: qlrd

src/krux/bip137.py

@@ -0,0 +1,77 @@
+# The MIT License (MIT)
+
+# Copyright (c) 2021-2026 Krux contributors
+
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+P2PKH_UNCOMPRESSED_HEADER = 27
+P2PKH_HEADER = 31
+P2SH_P2WPKH_HEADER = 35
+P2WPKH_HEADER = 39
+MESSAGE_MAGIC = b"\x18Bitcoin Signed Message:\n"
+RECID_OFFSET = P2PKH_HEADER - P2PKH_UNCOMPRESSED_HEADER
+
+
+def message_commitment(message):
+    """Double-SHA256 commitment over the BIP-137 magic"""
+    from embit import compact
+
+    try:
+        import uhashlib as hashlib
+    except ImportError:
+        import hashlib
+
+    # BIP137 commitment message:
+    # `SHA256(SHA256(MAGIC // varint // message))`
+    varint = compact.to_bytes(len(message))
+    _message = MESSAGE_MAGIC + varint + message
+    return hashlib.sha256(hashlib.sha256(_message).digest()).digest()
+
+
+def build_header(raw_sig, script_type, compressed=True):
+    """Build header byte from raw signature and script_type"""
+    # Avoid some unexpected header
+    rsig = raw_sig[0]
+    if not P2PKH_UNCOMPRESSED_HEADER <= rsig <= P2PKH_HEADER + 3:
+        raise ValueError("Invalid sig header: %d" % rsig)
+
+    # grab the 2 least significant bits as recId
+    # and normalize with a minimum p2pkh (uncompressed) flag
+    recid = (raw_sig[0] - P2PKH_UNCOMPRESSED_HEADER) & 3
+
+    if script_type == "p2sh-p2wpkh":
+        return P2SH_P2WPKH_HEADER + recid
+    if script_type == "p2wpkh":
+        return P2WPKH_HEADER + recid
+
+    # compressed=False is only meaningful for p2pkh
+    return (
+        P2PKH_UNCOMPRESSED_HEADER
+        + recid
+        + (0 if not compressed and script_type == "p2pkh" else RECID_OFFSET)
+    )
+
+
+def sign(message, key, derivation, script_type="p2pkh", compressed=True):
+    """Sign a BIP137 `message` with `key` at `derivation` for some `script_type`"""
+    commitment = message_commitment(message)
+    raw_sig = key.sign_at(derivation, commitment)
+    header = build_header(raw_sig, script_type, compressed)
+    sig = bytes([header]) + raw_sig[1:]
+    return (commitment, sig)

src/krux/pages/home_pages/sign_message_ui.py

@@ -20,7 +20,7 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
 
-from embit import bip32, compact, script
+from embit import bip32, script
 from embit.networks import NETWORKS
 import hashlib
 import binascii
@@ -133,7 +133,8 @@ def get_bitcoin_address(self, derivation_path, script_type=""):
         return addr
 
     def _sign_at_address(self, message, derivation_str, address=""):
-        """Signs a message at a derived Bitcoin address"""
+        """Signs a BIP137 message at a derived Bitcoin address"""
+        from krux import bip137
 
         derivation = bip32.parse_path(derivation_str)
         self._display_message_sign_prompt(
@@ -143,15 +144,8 @@ def _sign_at_address(self, message, derivation_str, address=""):
         if not self.prompt(t("Sign?"), BOTTOM_PROMPT_LINE):
             return None
 
-        message_hash = hashlib.sha256(
-            hashlib.sha256(
-                b"\x18Bitcoin Signed Message:\n"
-                + compact.to_bytes(len(message))
-                + message
-            ).digest()
-        ).digest()
-
-        sig = self.ctx.wallet.key.sign_at(derivation, message_hash)
+        script_type = self.get_script_type_from_path(derivation_str) or "p2pkh"
+        _, sig = bip137.sign(message, self.ctx.wallet.key, derivation, script_type)
         self._display_signature(base_encode(sig, 64))
         return sig
 
@@ -234,6 +228,8 @@ def _sign_at_address_from_sd(self, data):
 
     def sign_standard_message(self, data):
         """Signs a standard message"""
+        from krux import bip137
+
         message_hash, is_raw_hash = self._compute_message_hash(data)
         if message_hash is None:
             return ""
@@ -248,6 +244,8 @@ def sign_standard_message(self, data):
             )
             if not self.prompt(t("Proceed?"), BOTTOM_PROMPT_LINE):
                 return ""
+        else:
+            message_hash = bip137.message_commitment(data)
 
         self.ctx.display.clear()
         self.ctx.display.draw_centered_text(
@@ -257,7 +255,13 @@ def sign_standard_message(self, data):
         if not self.prompt(t("Sign?"), BOTTOM_PROMPT_LINE):
             return ""
 
-        sig = self.ctx.wallet.key.sign(message_hash).serialize()
+        key = self.ctx.wallet.key
+        if is_raw_hash:
+            sig = key.sign(message_hash).serialize()
+        else:
+            _, sig = bip137.sign(
+                data, key, bip32.parse_path(key.derivation), key.script_type
+            )
         self._display_signature(base_encode(sig, 64))
         return sig