Merge pull request #15 from BitHighlander/feat/zcash-seed-fingerprint

feat(zcash): seed_fingerprint client + tests

Author: BitHighlander

.gitmodules

@@ -1,6 +1,6 @@
 [submodule "device-protocol"]
 path = device-protocol
-url = https://github.com/keepkey/device-protocol.git
+url = https://github.com/BitHighlander/device-protocol.git
 branch = master
 [submodule "keepkeylib/eth/ethereum-lists"]
 path = keepkeylib/eth/ethereum-lists

device-protocol

@@ -1661,10 +1661,28 @@ def ton_sign_tx(self, address_n, raw_tx):
 
     # ── Zcash Address Display ─────────────────────────────────
     @expect(zcash_proto.ZcashAddress)
-    def zcash_display_address(self, address_n, address, ak, nk, rivk, account=None):
+    def zcash_display_address(self, address_n, address, ak, nk, rivk,
+                              account=None, expected_seed_fingerprint=None):
+        """Display a Zcash unified address on the device for user confirmation.
+
+        Args:
+            address_n: ZIP-32 derivation path [32', 133', account']
+            address: unified address string ("u1...")
+            ak, nk, rivk: 32-byte FVK components for verification
+            account: account index (alternative to full path)
+            expected_seed_fingerprint: optional 32-byte ZIP-32 §6.1 seed
+                fingerprint. If provided, device verifies the match before
+                displaying and rejects with Failure on mismatch.
+
+        Returns:
+            ZcashAddress with .address and .seed_fingerprint of the
+            attesting device.
+        """
         kwargs = dict(address_n=address_n, address=address, ak=ak, nk=nk, rivk=rivk)
         if account is not None:
             kwargs['account'] = account
+        if expected_seed_fingerprint is not None:
+            kwargs['expected_seed_fingerprint'] = expected_seed_fingerprint
         return self.call(zcash_proto.ZcashDisplayAddress(**kwargs))
 
     # ── Zcash Orchard ──────────────────────────────────────────
@@ -1681,7 +1699,8 @@ def zcash_sign_pczt(self, address_n, actions, account=None,
                         header_digest=None, transparent_digest=None,
                         sapling_digest=None, orchard_digest=None,
                         orchard_flags=None, orchard_value_balance=None,
-                        orchard_anchor=None, transparent_inputs=None):
+                        orchard_anchor=None, transparent_inputs=None,
+                        expected_seed_fingerprint=None):
         """Sign a Zcash Orchard shielded transaction via PCZT protocol.
 
         Phase 2: Sends ZcashSignPCZT, then loops on ZcashPCZTActionAck
@@ -1737,6 +1756,8 @@ def zcash_sign_pczt(self, address_n, actions, account=None,
             kwargs['orchard_value_balance'] = orchard_value_balance
         if orchard_anchor is not None:
             kwargs['orchard_anchor'] = orchard_anchor
+        if expected_seed_fingerprint is not None:
+            kwargs['expected_seed_fingerprint'] = expected_seed_fingerprint
 
         resp = self.call(zcash_proto.ZcashSignPCZT(**kwargs))
 

keepkeylib/client.py

@@ -0,0 +1,44 @@
+"""Zcash helpers for client-side computations.
+
+Mirrors the firmware's ZIP-32 §6.1 seed fingerprint so callers can build the
+expected_seed_fingerprint they pass to display/sign messages without having to
+ask the device.
+"""
+
+from hashlib import blake2b
+
+
+_PERSONAL = b"Zcash_HD_Seed_FP"
+
+
+def calculate_seed_fingerprint(seed):
+    """Compute the ZIP-32 §6.1 seed fingerprint.
+
+        SeedFingerprint := BLAKE2b-256(
+            "Zcash_HD_Seed_FP", I2LEBSP_8(len(seed)) || seed
+        )
+
+    The 1-byte length prefix domain-separates seeds of different lengths
+    that happen to share a prefix; per the spec.
+
+    Args:
+        seed: bytes, length 32-252.
+
+    Returns:
+        32-byte fingerprint.
+
+    Raises:
+        ValueError: if seed length is out of range or the seed is trivially
+            all-zero or all-0xFF (matches firmware's rejection per §6.1).
+    """
+    if not isinstance(seed, (bytes, bytearray)):
+        raise TypeError("seed must be bytes")
+    if len(seed) < 32 or len(seed) > 252:
+        raise ValueError("seed length must be in [32, 252]")
+    if all(b == 0x00 for b in seed) or all(b == 0xFF for b in seed):
+        raise ValueError("trivial seed (all-zero or all-0xFF) rejected")
+
+    h = blake2b(digest_size=32, person=_PERSONAL)
+    h.update(bytes([len(seed)]))
+    h.update(bytes(seed))
+    return h.digest()