Upgrade notebook 3.1 to use Bitcoin Core v0.21

Author: ellemouton

3.1-degrading-multisig-case-study.ipynb

@@ -10,7 +10,7 @@
     "import random\n",
     "\n",
     "import util\n",
-    "from test_framework.key import generate_key_pair, generate_schnorr_nonce, ECKey, ECPubKey, SECP256K1_FIELD_SIZE\n",
+    "from test_framework.key import generate_key_pair, generate_bip340_key_pair, generate_schnorr_nonce, ECKey, ECPubKey, SECP256K1_FIELD_SIZE, SECP256K1, SECP256K1_ORDER\n",
     "from test_framework.musig import aggregate_musig_signatures, aggregate_schnorr_nonces, generate_musig_key, musig_digest, sign_musig\n",
     "from test_framework.script import TapLeaf, TapTree, TaprootSignatureHash, SIGHASH_ALL_TAPROOT\n",
     "from test_framework.address import program_to_witness\n",
@@ -104,18 +104,18 @@
    "outputs": [],
    "source": [
     "# Generate main wallet key pairs\n",
-    "main_privkeyA, main_pubkeyA = generate_key_pair()\n",
-    "main_privkeyB, main_pubkeyB = generate_key_pair()\n",
-    "main_privkeyC, main_pubkeyC = generate_key_pair()\n",
+    "main_privkeyA, main_pubkeyA = generate_bip340_key_pair()\n",
+    "main_privkeyB, main_pubkeyB = generate_bip340_key_pair()\n",
+    "main_privkeyC, main_pubkeyC = generate_bip340_key_pair()\n",
     "main_pubkeys = [main_pubkeyA.get_bytes().hex(),\n",
     "                main_pubkeyB.get_bytes().hex(), \n",
     "                main_pubkeyC.get_bytes().hex()]\n",
     "\n",
     "print(\"Main pubkeys: {}\\n\".format(main_pubkeys))\n",
     "\n",
     "# Generate back-up wallet key pairs\n",
-    "backup_privkeyD, backup_pubkeyD = generate_key_pair()\n",
-    "backup_privkeyE, backup_pubkeyE = generate_key_pair()\n",
+    "backup_privkeyD, backup_pubkeyD = generate_bip340_key_pair()\n",
+    "backup_privkeyE, backup_pubkeyE = generate_bip340_key_pair()\n",
     "backup_pubkeys = [backup_pubkeyD.get_bytes().hex(),\n",
     "                  backup_pubkeyE.get_bytes().hex()]\n",
     "\n",
@@ -130,6 +130,15 @@
     "main_pubkeyB_c = main_pubkeyA.mul(c_map[main_pubkeyB])\n",
     "main_pubkeyC_c = main_pubkeyA.mul(c_map[main_pubkeyC])\n",
     "\n",
+    "if musig_ABC.get_y()%2 != 0:\n",
+    "    musig_ABC.negate()\n",
+    "    main_privkeyA_c.negate()\n",
+    "    main_privkeyB_c.negate()\n",
+    "    main_privkeyC_c.negate()\n",
+    "    main_pubkeyA_c.negate()\n",
+    "    main_pubkeyB_c.negate()\n",
+    "    main_pubkeyC_c.negate()\n",
+    "\n",
     "print(\"MuSig pubkey: {}\".format(musig_ABC.get_bytes().hex()))"
    ]
   },
@@ -180,7 +189,6 @@
     "taptweak = int.from_bytes(taptweak, 'big')\n",
     "output_pubkey = musig_ABC.tweak_add(taptweak)\n",
     "output_pubkey_b = output_pubkey.get_bytes()\n",
-    "taproot_pubkey_v1 = bytes([output_pubkey_b[0] & 1]) + output_pubkey_b[1:]\n",
     "segwit_address =  # TODO: implement\n",
     "print(\"Segwit Address:\", segwit_address)"
    ]
@@ -234,7 +242,7 @@
    "outputs": [],
    "source": [
     "# Send funds to taproot output.\n",
-    "txid = test.nodes[0].sendtoaddress(segwit_address, 0.5)\n",
+    "txid = test.nodes[0].sendtoaddress(address=segwit_address, amount=0.5, fee_rate=25)\n",
     "print(\"Funding tx:\", txid)\n",
     "\n",
     "# Deserialize wallet transaction.\n",
@@ -243,6 +251,10 @@
     "tx.deserialize(BytesIO(bytes.fromhex(tx_hex)))\n",
     "tx.rehash()\n",
     "\n",
+    "print(tapscript.hex())\n",
+    "\n",
+    "print(tx.vout)\n",
+    "\n",
     "# The wallet randomizes the change output index for privacy\n",
     "# Loop through the outputs and return the first where the scriptPubKey matches the segwit v1 output\n",
     "output_index, output = next(out for out in enumerate(tx.vout) if out[1].scriptPubKey == tapscript)\n",
@@ -333,7 +345,7 @@
    "source": [
     "#### 3.1.4 _Programming Exercise:_ Create a valid key path output\n",
     "\n",
-    "In this exercise, we'll spend the taproot output using the key path."
+    "In this exercise, we'll spend the taproot output using the key path. Since the key path is used, there is no control block to indicate whether or not the public key (Q) has an even or odd y-coordinate and so it is assumed that the y-coordinate is odd. Therefore, if Q needs to be negated, then so do all the private keys as well as the tweak."
    ]
   },
   {
@@ -342,6 +354,20 @@
    "metadata": {},
    "outputs": [],
    "source": [
+    "# Negate keys if necessary\n",
+    "output_keyPath = output_pubkey\n",
+    "privKeyA_keyPath = main_privkeyA_c\n",
+    "privKeyB_keyPath = main_privkeyB_c\n",
+    "privKeyC_keyPath = main_privkeyC_c\n",
+    "tweak_keyPath = taptweak\n",
+    "\n",
+    "if output_keyPath.get_y()%2 != 0:\n",
+    "    output_keyPath.negate()\n",
+    "    privKeyA_keyPath.negate()\n",
+    "    privKeyB_keyPath.negate()\n",
+    "    privKeyC_keyPath.negate()\n",
+    "    tweak_keyPath = SECP256K1_ORDER - taptweak\n",
+    "\n",
     "# Create sighash for ALL\n",
     "sighash_musig =  # TODO: implement\n",
     " \n",
@@ -354,7 +380,7 @@
     "sig_agg =  # TODO: implement\n",
     "print(\"Aggregate signature is {}\\n\".format(sig_agg.hex()))\n",
     "\n",
-    "assert output_pubkey.verify_schnorr(sig_agg, sighash_musig)\n",
+    "assert output_keyPath.verify_schnorr(sig_agg, sighash_musig)\n",
     "\n",
     "# Construct transaction witness\n",
     "spending_tx.wit.vtxinwit.append(  # TODO: implement\n",
@@ -395,7 +421,7 @@
     "spending_tx.vin = [spending_tx_in]\n",
     "spending_tx.vout = [dest_output]\n",
     "\n",
-    "sighash = TaprootSignatureHash(spending_tx, [output], SIGHASH_ALL_TAPROOT, 0, scriptpath=True, tapscript=tapscript_2a.script)\n",
+    "sighash = TaprootSignatureHash(spending_tx, [output], SIGHASH_ALL_TAPROOT, 0, scriptpath=True, script=tapscript_2a.script)\n",
     "\n",
     "witness_elements = []\n",
     "\n",
@@ -412,7 +438,7 @@
     "\n",
     "# Test timelock\n",
     "assert_equal(\n",
-    "    [{'txid': spending_tx.rehash(), 'allowed': False, 'reject-reason': '64: non-BIP68-final'}],\n",
+    "    [{'txid': spending_tx.rehash(), 'allowed': False, 'reject-reason': 'non-BIP68-final'}],\n",
     "    test.nodes[0].testmempoolaccept([spending_tx_str])\n",
     ")\n",
     "\n",
@@ -474,7 +500,7 @@
     "spending_tx.vin = [spending_tx_in]\n",
     "spending_tx.vout = [dest_output]\n",
     "\n",
-    "# Derive the sighash. Use tapscript_3a\n",
+    "# Derive the sighash. Use tapscript_3a.\n",
     "sighash =  # TODO: implement\n",
     "\n",
     "witness_elements = []\n",
@@ -483,13 +509,13 @@
     "# Remember to reverse the order of signatures\n",
     "witness_elements =  # TODO: implement\n",
     "\n",
-    "# Add witness to transaction\n",
+    "# Construct transaction witness\n",
     "spending_tx.wit.vtxinwit.append(CTxInWitness(witness_elements))\n",
     "spending_tx_str = spending_tx.serialize().hex()\n",
     "\n",
     "# Test timelock\n",
     "assert_equal(\n",
-    "    [{'txid': spending_tx.rehash(), 'allowed': False, 'reject-reason': '64: non-BIP68-final'}],\n",
+    "    [{'txid': spending_tx.rehash(), 'allowed': False, 'reject-reason': 'non-BIP68-final'}],\n",
     "    test.nodes[0].testmempoolaccept([spending_tx_str])\n",
     ")\n",
     "\n",

solutions/3.1-degrading-multisig-case-study-solutions.ipynb

@@ -53,6 +53,7 @@
    "outputs": [],
    "source": [
     "# Tapscripts - 2 main keys & 1 backup key\n",
+    "# Use construct_csa_delay() to construct the tapscript\n",
     "delay = 3*24*6\n",
     "tapscript_2a = TapLeaf().construct_csa_delay(3, [main_pubkeyA, main_pubkeyB, backup_pubkeyD], delay)\n",
     "tapscript_2b = TapLeaf().construct_csa_delay(3, [main_pubkeyA, main_pubkeyC, backup_pubkeyD], delay)\n",
@@ -73,6 +74,8 @@
     "                     tapscript_2d, tapscript_2e, tapscript_2f,\n",
     "                     tapscript_3a, tapscript_3b, tapscript_3c]\n",
     "\n",
+    "assert len(backup_tapscripts) == 9\n",
+    "\n",
     "# Construct taptree with huffman constructor\n",
     "tapscript_weights = [(2, tapscript_2a), (2, tapscript_2b), (2, tapscript_2c),\n",
     "                     (2, tapscript_2d), (2, tapscript_2e), (2, tapscript_2f),\n",
@@ -87,8 +90,7 @@
     "taptweak = int.from_bytes(taptweak, 'big')\n",
     "output_pubkey = musig_ABC.tweak_add(taptweak)\n",
     "output_pubkey_b = output_pubkey.get_bytes()\n",
-    "taproot_pubkey_v1 = bytes([output_pubkey_b[0] & 1]) + output_pubkey_b[1:]\n",
-    "segwit_address = program_to_witness(1, taproot_pubkey_v1)\n",
+    "segwit_address = program_to_witness(1, output_pubkey_b)\n",
     "print(\"Segwit Address:\", segwit_address)"
    ]
   },
@@ -105,6 +107,20 @@
    "metadata": {},
    "outputs": [],
    "source": [
+    "# Negate keys if necessary\n",
+    "output_keyPath = output_pubkey\n",
+    "privKeyA_keyPath = main_privkeyA_c\n",
+    "privKeyB_keyPath = main_privkeyB_c\n",
+    "privKeyC_keyPath = main_privkeyC_c\n",
+    "tweak_keyPath = taptweak\n",
+    "\n",
+    "if output_keyPath.get_y()%2 != 0:\n",
+    "    output_keyPath.negate()\n",
+    "    privKeyA_keyPath.negate()\n",
+    "    privKeyB_keyPath.negate()\n",
+    "    privKeyC_keyPath.negate()\n",
+    "    tweak_keyPath = SECP256K1_ORDER - taptweak\n",
+    "\n",
     "# Create sighash for ALL\n",
     "sighash_musig = TaprootSignatureHash(spending_tx, [output], SIGHASH_ALL_TAPROOT)\n",
     " \n",
@@ -121,22 +137,23 @@
     "\n",
     "# Create an aggregate signature.\n",
     "# Remember to add a factor for the tweak\n",
-    "sA = sign_musig(main_privkeyA_c, nonceA, R_agg, output_pubkey, sighash_musig)\n",
-    "sB = sign_musig(main_privkeyB_c, nonceB, R_agg, output_pubkey, sighash_musig)\n",
-    "sC = sign_musig(main_privkeyC_c, nonceC, R_agg, output_pubkey, sighash_musig)\n",
-    "e = musig_digest(R_agg, output_pubkey, sighash_musig)\n",
-    "sig_agg = aggregate_musig_signatures([sA, sB, sC, e * taptweak], R_agg)\n",
+    "sA = sign_musig(privKeyA_keyPath, nonceA, R_agg, output_pubkey, sighash_musig)\n",
+    "sB = sign_musig(privKeyB_keyPath, nonceB, R_agg, output_pubkey, sighash_musig)\n",
+    "sC = sign_musig(privKeyC_keyPath, nonceC, R_agg, output_pubkey, sighash_musig)\n",
+    "e = musig_digest(R_agg, output_keyPath, sighash_musig)\n",
+    "sig_agg = aggregate_musig_signatures([sA, sB, sC, e * tweak_keyPath], R_agg)\n",
+    "\n",
     "print(\"Aggregate signature is {}\\n\".format(sig_agg.hex()))\n",
     "\n",
-    "assert output_pubkey.verify_schnorr(sig_agg, sighash_musig)\n",
+    "assert output_keyPath.verify_schnorr(sig_agg, sighash_musig)\n",
     "\n",
-    "# Add witness to transaction\n",
+    "# Construct transaction witness\n",
     "spending_tx.wit.vtxinwit.append(CTxInWitness([sig_agg]))\n",
     " \n",
     "print(\"spending_tx: {}\\n\".format(spending_tx))\n",
     "\n",
     "# Test mempool acceptance\n",
-    "spending_tx_str = spending_tx.serialize().hex()\n",
+    "spending_tx_str = spending_tx.serialize().hex() \n",
     "assert test.nodes[0].testmempoolaccept([spending_tx_str])[0]['allowed']\n",
     "\n",
     "print(\"Key path spending transaction weight: {}\".format(test.nodes[0].decoderawtransaction(spending_tx_str)['weight']))\n",
@@ -167,7 +184,8 @@
     "spending_tx.vin = [spending_tx_in]\n",
     "spending_tx.vout = [dest_output]\n",
     "\n",
-    "sighash = TaprootSignatureHash(spending_tx, [output], SIGHASH_ALL_TAPROOT, 0, scriptpath=True, tapscript=tapscript_3a.script)\n",
+    "# Derive the sighash. Use tapscript_3a.\n",
+    "sighash = TaprootSignatureHash(spending_tx, [output], SIGHASH_ALL_TAPROOT, 0, scriptpath=True, script=tapscript_3a.script)\n",
     "\n",
     "witness_elements = []\n",
     "\n",
@@ -184,7 +202,7 @@
     "\n",
     "# Test timelock\n",
     "assert_equal(\n",
-    "    [{'txid': spending_tx.rehash(), 'allowed': False, 'reject-reason': '64: non-BIP68-final'}],\n",
+    "    [{'txid': spending_tx.rehash(), 'allowed': False, 'reject-reason': 'non-BIP68-final'}],\n",
     "    test.nodes[0].testmempoolaccept([spending_tx_str])\n",
     ")\n",
     "\n",

test_framework/script.py

@@ -1117,7 +1117,7 @@ def construct(self):
         tweak = tagged_hash("TapTweak", self.key.get_bytes() + h)
         tweaked = self.key.tweak_add(tweak)
         control_map = dict((script, GetVersionTaggedPubKey(self.key, version, tweaked) + control) for version, script, control in ctrl)
-        return (CScript([OP_1, GetVersionTaggedPubKey(tweaked, TAPROOT_VER, tweaked)]), tweak, control_map)
+        return (CScript([OP_1, tweaked.get_bytes()]), tweak, control_map)
 
     @staticmethod
     def _constructor(node):