fix(key_map): do not fulfill BIP32 requests outside descriptor path - #1004
Conversation
Remove the early `Xpriv::get_key` return in `DescriptorSecretKey::get_key`. That path matched on fingerprint only and ignored derivation path / wildcard, so a master xprv in e.g. `.../0/*` would sign sibling paths like `.../9/7`. Rely on `matches()` only. Assisted-by: Grok 4.5
Regression: master xprv descriptors such as `.../0/*` must not fulfill `KeyRequest::Bip32` for sibling paths like `.../9/7`. Assisted-by: Grok 4.5
|
@apoelstra friendly ping. I think this is important to fix asap |
|
Yeah, I think you're right. I'm torn about whether it's reasonable for a user to rely on this -- it seems like if you only want to sign with a certain key, you should only make that key available to your signer. But certainly, if a user does rely on this, we shouldn't be surprising them like that. In general, Miniscript has a bias toward "if the user has asked to sign, do anything possible to make the signing happen" on the assumption that if the user isn't allowed to make that decision, presumably they're physically unable to make that decision. |
|
Sorry for the long delay. Should be ACKed/merged today. If you could backport this to 12.x and 13.x (target branches |
2 participants
Description
GetKeybypassed descriptor path validation on fingerprint match, allowing a master xprv for…/0/*to sign sibling paths like…/9/7.Remove the early return and require
matches()before key derivation. Adds a regression test.