S5: SLIP-39 RS1024 encoding + Share codec#112
Draft
SachinMeier wants to merge 2 commits into
Draft
Conversation
SachinMeier
force-pushed
the
sachin--slip39-5-encoding-share
branch
from
8ef8a67 to
53a206a
Compare
SachinMeier
force-pushed
the
sachin--slip39-4-cipher
branch
from
b7440e5 to
9c16226
Compare
Collaborator
Author
|
Independent adversarial review (subagent) complete: no High/Medium findings, no security issues. RS1024 cross-checked against an independent Python implementation (40/40 cases); official-vector bit-decodes independently reproduced for vectors 1, 20, 42, 45 (incl. both extendable ones); validation order matches the trezor reference; hand mutation tests all rejected correctly. Addressed in the follow-up commit:
Note: S6 (#113) adjusts the pad_bits > 8 error from |
Add Bitcoinex.SLIP39.Encoding (RS1024 polymod/checksum over GF(1024) with shamir/shamir_extendable customization strings, plus 10-bit word index <-> word conversion against the 1024-word SLIP-39 list) and Bitcoinex.SLIP39.Share (bit-packed single-mnemonic codec: 15-bit identifier, extendable flag, iteration exponent, group/member metadata stored 1-based in the struct and minus-1 on the wire, zero left-padded share value, 3-word RS1024 checksum). decode/1 validates word membership, minimum 20-word length, RS1024 checksum (peeking the extendable bit to select the customization string), padding (pad_bits <= 8 and all-zero), and group_threshold <= group_count. Tests cover the spec's unit enumeration plus official trezor/python-shamir-mnemonic vectors (metadata decode for vectors 1/4/17/20 incl. a 33-word 256-bit share, byte-identical encode round-trip across all 45 vectors, and specific error atoms for the invalid-checksum/padding/length/group-threshold vectors), a StreamData round-trip property over random valid shares, and an RS1024 checksum-guarantee property mutating 1-3 words. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- add decoder-never-raises fuzz properties for Share.decode/1 over arbitrary strings and random valid-word sequences (parity with the BIP-39 decoder fuzz) - pin the extendable-flag wire path with a named assertion on official vector 42 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
SachinMeier
force-pushed
the
sachin--slip39-4-cipher
branch
from
9c16226 to
cad06d0
Compare
SachinMeier
force-pushed
the
sachin--slip39-5-encoding-share
branch
from
53a206a to
5340708
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack: S0 → S1 → S2 → S3 → S4 → S5 → S6 (spec §3.7, §3.8)
Bitcoinex.SLIP39.Encoding: RS1024 polymod (bech32-polymod style) with "shamir"/"shamir_extendable" customization, checksum create/verify, word↔index mappingBitcoinex.SLIP39.Share: bit-exact wire codec; decode validates length, RS1024 (ext bit peeked pre-verify), ≤8-bit zero padding, GT≤G; encode is total on valid structs🤖 Generated with Claude Code