HMAC-SHA512: Bitcoin's HD Wallet Key Derivation

# Setup (simplified for education)
block_size = 8 bytes
hash_output = 4 bytes (normally 64 for SHA-512)
key = [0x01, 0x02, 0x03, 0x04]  # 4 bytes (pad with zeros)
message = b"Hi"

# Step 1: Pad key to block size
K_prime = [0x01, 0x02, 0x03, 0x04, 0x00, 0x00, 0x00, 0x00]

# Step 2: XOR with ipad (0x36)
ipad = [0x36] * 8
K_inner = [k ^ 0x36 for k in K_prime]
# Result: [0x37, 0x34, 0x35, 0x32, 0x36, 0x36, 0x36, 0x36]

# Step 3: Append message and hash
inner_data = bytes(K_inner) + message  # 8 + 2 = 10 bytes
inner_hash = simple_hash(inner_data)   # 4-byte output

# Step 4: XOR with opad (0x5C)
opad = [0x5C] * 8
K_outer = [k ^ 0x5C for k in K_prime]
# Result: [0x5D, 0x5E, 0x5F, 0x58, 0x5C, 0x5C, 0x5C, 0x5C]

# Step 5: Hash again
outer_data = bytes(K_outer) + inner_hash
final_hmac = simple_hash(outer_data)

import hmac
import hashlib

import hmac
import hashlib

# Secret key (32 bytes = 256 bits, Bitcoin standard)
key = b"my_super_secret_key_for_hd_wallet_32bytes!"
# Message to authenticate
message = b"derive child key with index 0"

# Compute HMAC-SHA512
hmac_result = hmac.new(key, message, hashlib.sha512).digest()
print(f"HMAC-SHA512 (64 bytes): {hmac_result.hex()}")
print(f"Length: {len(hmac_result)} bytes")
print(f"Left 256 bits (private key): {hmac_result[:32].hex()}")
print(f"Right 256 bits (chain code): {hmac_result[32:].hex()}")

import hmac
import hashlib
import struct

def hmac_sha512(key, message):
    """Compute HMAC-SHA512 exactly as used in BIP32"""
    return hmac.new(key, message, hashlib.sha512).digest()

def derive_child_key(parent_private_key, parent_chain_code, index, hardened=False):
    """
    Derive a child key following BIP32 specification.
    
    Args:
        parent_private_key: 32-byte parent private key
        parent_chain_code: 32-byte parent chain code
        index: 32-bit integer (0 to 2^31-1 for normal, 2^31 to 2^32-1 for hardened)
        hardened: If True, index is ORed with 0x80000000
    
    Returns:
        child_private_key: 32-byte child private key
        child_chain_code: 32-byte new chain code
    """
    # Hardened derivation uses private key + index
    if hardened:
        # Hardened keys use index >= 0x80000000 (2^31)
        actual_index = index | 0x80000000
        data = b'\x00' + parent_private_key + struct.pack('>I', actual_index)
    else:
        # Normal derivation uses public key + index
        # For simplicity, we'll use the private key's public key here
        # In real BIP32, you'd need point multiplication
        actual_index = index
        # Placeholder: normally you'd compute public key from private key
        # For this example, we'll use the private key with a marker
        data = parent_private_key + struct.pack('>I', actual_index)
    
    # Compute HMAC-SHA512
    hmac_result = hmac_sha512(parent_chain_code, data)
    
    # Split into two 256-bit halves
    child_private_key = hmac_result[:32]
    child_chain_code = hmac_result[32:]
    
    return child_private_key, child_chain_code

def mnemonic_to_seed(mnemonic, passphrase=""):
    """
    Convert a BIP39 mnemonic to a 512-bit seed using PBKDF2-HMAC-SHA512.
    This is how your recovery phrase becomes your master private key!
    """
    from hashlib import pbkdf2_hmac
    
    salt = "mnemonic" + passphrase
    # 2048 rounds of HMAC-SHA512
    seed = pbkdf2_hmac('sha512', mnemonic.encode('utf-8'), 
                       salt.encode('utf-8'), 2048, 64)
    return seed

# Example usage
if __name__ == '__main__':
    # In a real wallet, this would come from your seed phrase
    # For demo, we use a test private key (NEVER use this for real funds!)
    test_private_key = bytes.fromhex(
        "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"
    )
    test_chain_code = bytes.fromhex(
        "f0909affaa7ee7abe5dd4e100598d4dc53cd709d5a5c2cac40e7412f232f7c9c"
    )
    
    print("BIP32 Key Derivation Example:")
    print("=" * 50)
    
    # Derive a normal child (index 0)
    child_key, child_cc = derive_child_key(
        test_private_key, test_chain_code, 0, hardened=False
    )
    print(f"Normal child (index 0):")
    print(f"  Private key: {child_key.hex()[:32]}...")
    print(f"  Chain code:  {child_cc.hex()[:32]}...")
    
    # Derive a hardened child (index 0 hardened = 0x80000000)
    hardened_key, hardened_cc = derive_child_key(
        test_private_key, test_chain_code, 0, hardened=True
    )
    print(f"\nHardened child (index 0'):")
    print(f"  Private key: {hardened_key.hex()[:32]}...")
    print(f"  Chain code:  {hardened_cc.hex()[:32]}...")
    
    # Derive from the child (grandchild)
    grandchild_key, grandchild_cc = derive_child_key(
        child_key, child_cc, 5, hardened=False
    )
    print(f"\nGrandchild (index 5 of normal child):")
    print(f"  Private key: {grandchild_key.hex()[:32]}...")
    
    # Mnemonic to seed example
    print("\n" + "=" * 50)
    print("BIP39 Mnemonic to Seed:")
    mnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
    seed = mnemonic_to_seed(mnemonic)
    print(f"Seed (512 bits): {seed.hex()[:32]}... (truncated)")
    print(f"Seed length: {len(seed)} bytes (512 bits)")

import hmac
import hashlib

def safe_verify_hmac(key, message, received_hmac):
    """
    Securely verify an HMAC (constant-time comparison!)
    """
    try:
        # Compute expected HMAC
        expected = hmac.new(key, message, hashlib.sha512).digest()
        
        # CRITICAL: Use compare_digest() NOT ==
        # compare_digest prevents timing attacks
        if hmac.compare_digest(expected, received_hmac):
            return True, "HMAC valid"
        else:
            return False, "HMAC invalid - message may be tampered"
    except TypeError as e:
        return False, f"Invalid key or message type: {e}"
    except Exception as e:
        return False, f"Unexpected error: {e}"

# Examples of what can go wrong
key = b"my_secret_key"
message = b"important data"
correct_hmac = hmac.new(key, message, hashlib.sha512).digest()

# Wrong key
wrong_key = b"wrong_key"
valid, msg = safe_verify_hmac(wrong_key, message, correct_hmac)
print(f"Wrong key: {msg}")  # "HMAC invalid"

# Wrong message
wrong_message = b"different data"
valid, msg = safe_verify_hmac(key, wrong_message, correct_hmac)
print(f"Wrong message: {msg}")  # "HMAC invalid"

# Empty key (works but UNSECURE - don't do this!)
empty_key = b""
weak_hmac = hmac.new(empty_key, message, hashlib.sha512).digest()
valid, msg = safe_verify_hmac(empty_key, message, weak_hmac)
print(f"Empty key: {msg}")  # "HMAC valid" (but it's trivial to forge!)

# Correct verification
valid, msg = safe_verify_hmac(key, message, correct_hmac)
print(f"Correct: {msg}")

import hmac
import hashlib

# Test vector 1 from RFC 4231
key = bytes.fromhex("0b" * 20)
message = b"Hi There"
expected_first_32 = "b936cee86c9f87aa5d3c6f2e84cb5a4239"

result = hmac.new(key, message, hashlib.sha512).digest()
print(f"Test Vector 1:")
print(f"  Got:      {result.hex()[:32]}")
print(f"  Expected: {expected_first_32}")
print(f"  Match:    {result.hex()[:32] == expected_first_32}")