2

I'm trying to code up BIP0032, with full test coverage and I hit a snag with these very rare edge cases:

Private parent key → private child key

In case parse256(IL) ≥ n or ki = 0, the resulting key is invalid, and one should proceed with the next value for i. (Note: this has probability lower than 1 in 2^127.)

Public parent key → public child key

In case parse256(IL) ≥ n or Ki is the point at infinity, the resulting key is invalid, and one should proceed with the next value for i.

I have not written any code around these conditions as without test cases to show I have done it correctly, it's pointless.

I've successfully tested my code with 30 million addresses generated from another library, but I think to stand a better than 50/50 chance of finding one of these edge cases I would have to check in the order of 10^19 (source: Birthday attack).

So my question is, does anyone have any test vectors for these cases?

The alternative is to have a whitebox test that passes bad IL values directly to an otherwise private function, but I'd rather have a blackbox test.

Improve this question

1 Answer 1

Reset to default
3
+25

I doubt anyone will have such a value since it would require a tremendous amount of computation. One approach would be to monkey patch your HMAC-SHA512 function to return a value with 32 leading zero bytes for the purpose of the test.

Improve this answer
3
  • I think you're probably correct, and this is exactly what I ended up doing, see fakeHmacSha512Responses github.com/NovaCrypto/BIP32/blob/master/src/test/java/io/github/…
    – weston
    Jun 11, 2018 at 11:19
  • why is the sentence there if it will never happen? also, what happens if there is no "next value for i"? The last key could be invalid. If the BIP is attempting to handle all cases (even 'impossible' ones), it should handle this one too.
    – Janus Troelsen
    Jun 11, 2018 at 14:01
  • @JanusTroelsen No one said "it will never happen" (although chances are it won't). I said that probably no one has spent several PHs to calculate such a preimage to use for a unit test.
    – Mike D
    Jun 11, 2018 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.