Silent Payments: Implement bip352 (take 2) #35301

  20 | +#include <script/solver.h>
  21 | +#include <script/script_error.h>
  22 | +#include <util/check.h>
  23 | +#include <util/strencodings.h>
  24 | +
  25 | +extern secp256k1_context* secp256k1_context_sign; // TODO: this is hacky, is there a better solution?

---

  98 | + * Label public keys can be stored in a cache, mapping the public key to the label tweak. This cache
  99 | + * is used during scanning to determine if a label was used and if so to retrieve the label tweak.
 100 | + *
 101 | + * @param scan_key                 The recipient's scan_key, used to salt the hash
 102 | + * @param m                        An integer m (only use m = 0 for the change label)
 103 | + * @return std::<CPubKey, uint156> The label public key and label tweak.

---

 151 | + * @param spend_pubkey                                      The recipient's spend public key.
 152 | + * @param output_pub_keys                                   The taproot output public keys.
 153 | + * @param labels                                            The recipient's labels.
 154 | + * @return std::<optional<std::vector<SilentPaymentOutput>> The found outputs, nullopt if none found.
 155 | + */
 156 | +std::optional<std::vector<SilentPaymentOutput>> ScanForSilentPaymentOutputs(const CKey& scan_key, const PrevoutsSummary& prevouts_summary, const CPubKey& spend_pubkey, const std::vector<XOnlyPubKey>& output_pub_keys, const std::map<CPubKey, uint256>& labels);

---

 206 | +    generated_output_ptrs.reserve(recipients.size());
 207 | +
 208 | +    for (size_t i = 0; i < recipients.size(); i++) {
 209 | +        secp256k1_silentpayments_recipient recipient_obj;
 210 | +        ret = secp256k1_ec_pubkey_parse(secp256k1_context_static, &recipient_obj.scan_pubkey, recipients[i].m_scan_pubkey.data(), recipients[i].m_scan_pubkey.size());
 211 | +        ret = secp256k1_ec_pubkey_parse(secp256k1_context_static, &recipient_obj.spend_pubkey, recipients[i].m_spend_pubkey.data(), recipients[i].m_spend_pubkey.size());

---

 331 | +        secp256k1_silentpayments_found_output found_output{};
 332 | +        secp256k1_xonly_pubkey tx_output_obj;
 333 | +        found_output_objs.push_back(found_output);
 334 | +        found_output_ptrs.push_back(&found_output_objs[i]);
 335 | +        ret = secp256k1_xonly_pubkey_parse(secp256k1_context_static, &tx_output_obj, tx_outputs[i].data());
 336 | +        assert(ret);

---

  27 | +namespace bip352 {
  28 | +
  29 | +class PrevoutsSummaryImpl
  30 | +{
  31 | +private:
  32 | +    //! The actual secnonce itself

---

 158 | @@ -140,7 +159,7 @@ struct PayToAnchor : public WitnessUnknown
 159 |   *  * WitnessUnknown: TxoutType::WITNESS_UNKNOWN destination (P2W??? address)
 160 |   *  A CTxDestination is the internal data type encoded in a bitcoin address
 161 |   */
 162 | -using CTxDestination = std::variant<CNoDestination, PubKeyDestination, PKHash, ScriptHash, WitnessV0ScriptHash, WitnessV0KeyHash, WitnessV1Taproot, PayToAnchor, WitnessUnknown>;
 163 | +using CTxDestination = std::variant<CNoDestination, V0SilentPaymentDestination, PubKeyDestination, PKHash, ScriptHash, WitnessV0ScriptHash, WitnessV0KeyHash, WitnessV1Taproot, PayToAnchor, WitnessUnknown>;

---

  36 | @@ -37,6 +37,7 @@ enum class Encoding {
  37 |   *  and we would never encode an address with such a massive value */
  38 |  enum CharLimit : size_t {
  39 |      BECH32 = 90,            //!< BIP173/350 imposed character limit for Bech32(m) encoded addresses. This guarantees finding up to 4 errors.
  40 | +    SILENT_PAYMENTS = 1024, //!< BIP352 imposed 1024 character limit on Bech32m encoded silent payment addresses. This guarantees finding up to 3 errors

---