keystore: derive bip86 pubkey from xpub, not from xprv

Before we used a shared helper function that computes the bip86
keypair for both getting the pubkey as well as signing, as the
priv/pubkeys get tweaked with the same tweak.

We might want to implement xpub caching to not re-derive xpubs from
the seed more than needed (e.g. when loading many inputs in a BTC
transaction), in which case we must be able to derive the bip86 pubkey
from an xpub alone, not from an xprv.

Author: benma

src/keystore.c

@@ -795,6 +795,46 @@ static void _tagged_hash(const char* tag, const uint8_t* msg, size_t msg_len, ui
     rust_sha256_finish(&hash_ctx, hash_out);
 }
 
+bool keystore_secp256k1_schnorr_bip86_pubkey(
+    const uint32_t* keypath,
+    size_t keypath_len,
+    uint8_t* pubkey_out)
+{
+    if (keystore_is_locked()) {
+        return false;
+    }
+    struct ext_key xpub __attribute__((__cleanup__(keystore_zero_xkey))) = {0};
+    if (!keystore_get_xpub(keypath, keypath_len, &xpub)) {
+        return false;
+    }
+
+    const secp256k1_context* ctx = wally_get_secp_context();
+
+    secp256k1_pubkey pubkey = {0};
+    if (!secp256k1_ec_pubkey_parse(ctx, &pubkey, xpub.pub_key, sizeof(xpub.pub_key))) {
+        return false;
+    }
+    secp256k1_xonly_pubkey xonly_pubkey = {0};
+    if (!secp256k1_xonly_pubkey_from_pubkey(ctx, &xonly_pubkey, NULL, &pubkey)) {
+        return false;
+    }
+    uint8_t xonly_pubkey_serialized[32] = {0};
+    if (!secp256k1_xonly_pubkey_serialize(ctx, xonly_pubkey_serialized, &xonly_pubkey)) {
+        return false;
+    }
+    uint8_t hash[32] = {0};
+    secp256k1_pubkey tweaked_pubkey = {0};
+    _tagged_hash("TapTweak", xonly_pubkey_serialized, sizeof(xonly_pubkey_serialized), hash);
+    if (!secp256k1_xonly_pubkey_tweak_add(ctx, &tweaked_pubkey, &xonly_pubkey, hash)) {
+        return false;
+    }
+    secp256k1_xonly_pubkey tweaked_xonly_pubkey = {0};
+    if (!secp256k1_xonly_pubkey_from_pubkey(ctx, &tweaked_xonly_pubkey, NULL, &tweaked_pubkey)) {
+        return false;
+    }
+    return secp256k1_xonly_pubkey_serialize(ctx, pubkey_out, &tweaked_xonly_pubkey) == 1;
+}
+
 static bool _schnorr_bip86_keypair(
     const uint32_t* keypath,
     size_t keypath_len,
@@ -834,20 +874,6 @@ static void _cleanup_keypair(secp256k1_keypair* keypair)
     util_zero(keypair, sizeof(secp256k1_keypair));
 }
 
-bool keystore_secp256k1_schnorr_bip86_pubkey(
-    const uint32_t* keypath,
-    size_t keypath_len,
-    uint8_t* pubkey_out)
-{
-    secp256k1_keypair __attribute__((__cleanup__(_cleanup_keypair))) keypair = {0};
-    secp256k1_xonly_pubkey pubkey = {0};
-    if (!_schnorr_bip86_keypair(keypath, keypath_len, &keypair, &pubkey)) {
-        return false;
-    }
-    const secp256k1_context* ctx = wally_get_secp_context();
-    return secp256k1_xonly_pubkey_serialize(ctx, pubkey_out, &pubkey) == 1;
-}
-
 bool keystore_secp256k1_schnorr_bip86_sign(
     const uint32_t* keypath,
     size_t keypath_len,