S4: SLIP-39 Feistel encryption (Cipher)#111
Draft
SachinMeier wants to merge 2 commits into
Draft
Conversation
SachinMeier
force-pushed
the
sachin--slip39-3-gf256-shamir
branch
from
595d728 to
6360071
Compare
SachinMeier
force-pushed
the
sachin--slip39-4-cipher
branch
from
b7440e5 to
9c16226
Compare
Collaborator
Author
|
Independent adversarial review (subagent) complete: APPROVE, no correctness/security findings. Independent Python implementation of the SLIP-39 cipher matched byte-for-byte on all 10 random tuples (including decrypt-applied-to-plaintext, which catches round-order errors round-trips cannot); the known-answer test's hand-extracted vector-0 parameters (id 7945, ext false, e 0) were independently re-derived and confirmed. Addressed in the follow-up commit:
|
Add Bitcoinex.SLIP39.Cipher with encrypt/5 and decrypt/5: the four-round balanced Feistel cipher SLIP-39 uses to turn a master secret into an encrypted master secret under a passphrase. Both directions share one private feistel/6 helper; the round function is PBKDF2-HMAC-SHA256 with 2500 <<< iteration_exponent iterations per round, salted with "shamir" <> <<identifier::16>> (or an empty salt for extendable share sets). Tests cover round-trip identity across ext/e/passphrase/MS-length combinations, salt and iteration-exponent threading, a stream_data round-trip property, and a known-answer test that hand-extracts the EMS and cipher parameters from official SLIP-39 vector 1's mnemonic wire layout and asserts decryption recovers the vector's master secret. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Guard encrypt/5 and decrypt/5 against odd-length and empty input at the public boundary so misuse fails as a clear FunctionClauseError rather than a MatchError inside the Feistel split. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
SachinMeier
force-pushed
the
sachin--slip39-4-cipher
branch
from
9c16226 to
cad06d0
Compare
SachinMeier
force-pushed
the
sachin--slip39-3-gf256-shamir
branch
from
6360071 to
d77750f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack: S0 → S1 → S2 → S3 → S4 → S5 → S6 (spec §3.6)
Bitcoinex.SLIP39.Cipher: 4-round balanced Feistel, round fn PBKDF2-HMAC-SHA256 with2500 << eiterations/round; salt"shamir" <> id(ext=false) or empty (ext=true); one sharedfeistelhelper for both directionsdecrypt(ems)==msandencrypt(ms)==ems🤖 Generated with Claude Code