descriptor: support parsing descriptors as elements descriptors

Elements core supports standard descriptors but generates (at least for
taproot) different scriptpubkeys/addresses since it uses a different hash
to tweak its internal keys. Allow specifying that a descriptor is an
Elements descriptor when parsing, and use this to perform the correct
tweak.

Its unclear whether other descriptor expressions are affacted since
there is no documentation of this behaviour.

Elements (only via rust-elements) also supports a renamed set of
descriptors and extensions which we do not attempt to support in this
change.

Author: jgriffiths

include/wally_descriptor.h

@@ -17,18 +17,20 @@ struct wally_descriptor;
 #define WALLY_MINISCRIPT_REQUIRE_CHECKSUM 0x04 /** Require a checksum to be present */
 #define WALLY_MINISCRIPT_POLICY_TEMPLATE  0x08 /** Only allow policy templates with @n BIP32 keys */
 #define WALLY_MINISCRIPT_UNIQUE_KEYPATHS  0x10 /** For policy templates, ensure BIP32 derivation paths differ for identical keys */
+#define WALLY_MINISCRIPT_IS_ELEMENTS      0x20 /** Treat non-elements expressions as elements, e.g. tr() as eltr() */
 #define WALLY_MINISCRIPT_DEPTH_MASK       0xffff0000 /** Mask for limiting maximum depth */
 #define WALLY_MINISCRIPT_DEPTH_SHIFT      16 /** Shift to convert maximum depth to flags */
 
 /*** miniscript-features Miniscript/Descriptor feature flags */
-#define WALLY_MS_IS_RANGED       0x01 /** Allows key ranges via ``*`` */
-#define WALLY_MS_IS_MULTIPATH    0x02 /** Allows multiple paths via ``<a;b;c>`` */
-#define WALLY_MS_IS_PRIVATE      0x04 /** Contains at least one private key */
-#define WALLY_MS_IS_UNCOMPRESSED 0x08 /** Contains at least one uncompressed key */
-#define WALLY_MS_IS_RAW          0x10 /** Contains at least one raw key */
-#define WALLY_MS_IS_DESCRIPTOR   0x20 /** Contains only descriptor expressions (no miniscript) */
-#define WALLY_MS_IS_X_ONLY       0x40 /** Contains at least one x-only key */
-#define WALLY_MS_IS_PARENTED     0x80 /** Contains at least one key key with a parent key origin */
+#define WALLY_MS_IS_RANGED       0x001 /** Allows key ranges via ``*`` */
+#define WALLY_MS_IS_MULTIPATH    0x002 /** Allows multiple paths via ``<a;b;c>`` */
+#define WALLY_MS_IS_PRIVATE      0x004 /** Contains at least one private key */
+#define WALLY_MS_IS_UNCOMPRESSED 0x008 /** Contains at least one uncompressed key */
+#define WALLY_MS_IS_RAW          0x010 /** Contains at least one raw key */
+#define WALLY_MS_IS_DESCRIPTOR   0x020 /** Contains only descriptor expressions (no miniscript) */
+#define WALLY_MS_IS_X_ONLY       0x040 /** Contains at least one x-only key */
+#define WALLY_MS_IS_PARENTED     0x080 /** Contains at least one key key with a parent key origin */
+#define WALLY_MS_IS_ELEMENTS     0x100 /** Contains Elements expressions or was parsed as Elements */
 
 /*** ms-canonicalization-flags Miniscript/Descriptor canonicalization flags */
 #define WALLY_MS_CANONICAL_NO_CHECKSUM 0x01 /** Do not include a checksum */

src/ctest/test_descriptor.c

@@ -43,7 +43,9 @@ static struct wally_map_item g_key_map_items[] = {
     { B("mainnet_xpriv"), B("xprvA2YKGLieCs6cWCiczALiH1jzk3VCCS5M1pGQfWPkamCdR9UpBgE2Gb8AKAyVjKHkz8v37avcfRjdcnP19dVAmZrvZQfvTcXXSAiFNQ6tTtU") },
     { B("uncompressed"), B("0414fc03b8df87cd7b872996810db8458d61da8448e531569c8517b469a119d267be5645686309c6e6736dbd93940707cc9143d3cf29f1b877ff340e2cb2d259cf") },
     { B("x_only"), B("b71aa79cab0ae2d83b82d44cbdc23f5dcca3797e8ba622c4e45a8f7dce28ba0e") },
-    { B("non_x_only"), B("03b71aa79cab0ae2d83b82d44cbdc23f5dcca3797e8ba622c4e45a8f7dce28ba0e") }
+    { B("non_x_only"), B("03b71aa79cab0ae2d83b82d44cbdc23f5dcca3797e8ba622c4e45a8f7dce28ba0e") },
+    /* The taproot singlesig xpriv corresponding to Jades test_jade.py test script */
+    { B("jade_ss_tr_xpriv"), B("tprv8gTfWnFCND72oJZfZTokBBXcS1FzQhrtd5wNFu3FgBE76yErH49cev2Zn3Wws3o6ZwKZVZaQP1UWKVNotpPg8U6tCgGrjMfaRQJvV1Vdbi7") }
 };
 
 static const struct wally_map g_key_map = {
@@ -395,7 +397,17 @@ static const struct descriptor_test {
         WALLY_NETWORK_BITCOIN_REGTEST, 0, 0, 0, NULL, 0,
         "51205fb8e39dbbdc7c831af59e44a9b2997f9daaf72c3e965b30982f3c731539e1db",
         "tp2ky708"
-    },{
+    },
+#ifdef BUILD_ELEMENTS
+    {
+        "descriptor - Elements tr",
+        "tr([59d1f3b0/86h/1h/0h]jade_ss_tr_xpriv/0/*)",
+        WALLY_NETWORK_NONE, 0, 0, 0, NULL, WALLY_MINISCRIPT_IS_ELEMENTS,
+        "5120900d1d75269396d4220c4529527dbcb746a6093c7209cea2d76a87c8ab9447fc",
+        "3d4maj53"
+    },
+#endif
+    {
         "descriptor - A single key",
         "wsh(c:pk_k(key_1))",
         WALLY_NETWORK_NONE, 0, 0, 0, NULL, 0,

src/descriptor.c

@@ -18,7 +18,8 @@
         WALLY_MINISCRIPT_ONLY | \
         WALLY_MINISCRIPT_REQUIRE_CHECKSUM | \
         WALLY_MINISCRIPT_POLICY_TEMPLATE | \
-        WALLY_MINISCRIPT_UNIQUE_KEYPATHS)
+        WALLY_MINISCRIPT_UNIQUE_KEYPATHS | \
+        WALLY_MINISCRIPT_IS_ELEMENTS)
 #define MS_FLAGS_CANONICALIZE (WALLY_MINISCRIPT_REQUIRE_CHECKSUM | \
         WALLY_MINISCRIPT_POLICY_TEMPLATE)
 
@@ -177,8 +178,8 @@ typedef struct ms_node_t {
     uint32_t data_len;
     uint32_t child_path_len;
     char wrapper_str[12];
+    unsigned short flags; /* WALLY_MS_IS_ flags */
     unsigned char builtin;
-    unsigned char flags; /* WALLY_MS_IS_ flags */
 } ms_node;
 
 typedef struct wally_descriptor {
@@ -1293,7 +1294,7 @@ static int generate_sh_wpkh(ms_ctx *ctx, ms_node *node,
     ms_node sh_node = { NULL, node, NULL, KIND_DESCRIPTOR_SH,
                         TYPE_NONE, 0, NULL, NULL, 0, 0,
                         {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
-                        builtin_sh_index, 0 };
+                        0, builtin_sh_index };
 
     if (ctx->variant != 3)
         return WALLY_ERROR; /* Should only be called to generate sh-wpkh */
@@ -1423,6 +1424,7 @@ static int generate_tr(ms_ctx *ctx, ms_node *node,
     unsigned char tweaked[EC_PUBLIC_KEY_LEN];
     unsigned char pubkey[EC_PUBLIC_KEY_UNCOMPRESSED_LEN + 1];
     size_t pubkey_len = 0;
+    uint32_t tweak_flags = 0;
     int ret;
 
     /* Generate a push of the x-only public key of our child */
@@ -1432,9 +1434,13 @@ static int generate_tr(ms_ctx *ctx, ms_node *node,
         return WALLY_EINVAL; /* Should be PUSH_32 [x-only pubkey] */
 
     /* Tweak it into a compressed pubkey */
+#ifdef BUILD_ELEMENTS
+    if (node->flags & WALLY_MS_IS_ELEMENTS)
+        tweak_flags = EC_FLAG_ELEMENTS;
+#endif
     ret = wally_ec_public_key_bip341_tweak(pubkey + 1, pubkey_len - 1,
-                                           NULL, 0, 0, /* FIXME: Support script path */
-                                           tweaked, sizeof(tweaked));
+                                           NULL, 0, /* FIXME: Support script path */
+                                           tweak_flags, tweaked, sizeof(tweaked));
 
     if (ret == WALLY_OK && script_len >= WALLY_SCRIPTPUBKEY_P2TR_LEN) {
         /* Generate the script using the x-only part of the tweaked key */
@@ -2378,6 +2384,10 @@ static int analyze_miniscript(ms_ctx *ctx, const char *str, size_t str_len,
         return WALLY_ENOMEM;
 
     node->parent = parent;
+#ifdef BUILD_ELEMENTS
+    if (flags & WALLY_MINISCRIPT_IS_ELEMENTS)
+        node->flags |= WALLY_MS_IS_ELEMENTS; /* Treat this node as an elements node */
+#endif
 
     for (i = 0; i < str_len; ++i) {
         if (!node->builtin && str[i] == ':') {
@@ -2745,6 +2755,11 @@ int wally_descriptor_parse(const char *miniscript,
         (network != WALLY_NETWORK_NONE && !addr_ver))
         return WALLY_EINVAL;
 
+#ifndef BUILD_ELEMENTS
+    if (flags & WALLY_MINISCRIPT_IS_ELEMENTS) {
+        return WALLY_EINVAL;
+    }
+#endif
     /* Allocate a context to hold the canonicalized/parsed expression */
     if (!(*output = wally_calloc(sizeof(ms_ctx))))
         return WALLY_ENOMEM;
@@ -2830,6 +2845,11 @@ int wally_descriptor_to_script_get_maximum_length(
         *written = 0;
     if (!descriptor || (flags & ~MS_FLAGS_ALL) || !written)
         return WALLY_EINVAL;
+#ifndef BUILD_ELEMENTS
+    if (flags & WALLY_MINISCRIPT_IS_ELEMENTS) {
+        return WALLY_EINVAL;
+    }
+#endif
     *written = descriptor->script_len;
     return WALLY_OK;
 }

src/wasm_package/src/const.js

@@ -122,21 +122,23 @@ export const WALLY_MAJOR_VER = 1;
 export const WALLY_MAX_OP_RETURN_LEN = 80; /* Maximum length of OP_RETURN data push */
 export const WALLY_MINISCRIPT_DEPTH_MASK = 0xffff0000; /** Mask for limiting maximum depth */
 export const WALLY_MINISCRIPT_DEPTH_SHIFT = 16; /** Shift to convert maximum depth to flags */
+export const WALLY_MINISCRIPT_IS_ELEMENTS = 0x20; /** Treat non-elements expressions as elements, e.g. tr() as eltr() */
 export const WALLY_MINISCRIPT_ONLY = 0x02; /** Only allow miniscript (not descriptor) expressions */
 export const WALLY_MINISCRIPT_POLICY_TEMPLATE = 0x08; /** Only allow policy templates with @n BIP32 keys */
 export const WALLY_MINISCRIPT_REQUIRE_CHECKSUM = 0x04; /** Require a checksum to be present */
 export const WALLY_MINISCRIPT_TAPSCRIPT = 0x01; /** Tapscript, use x-only pubkeys */
 export const WALLY_MINISCRIPT_UNIQUE_KEYPATHS = 0x10; /** For policy templates, ensure BIP32 derivation paths differ for identical keys */
 export const WALLY_MINOR_VER = 3;
 export const WALLY_MS_CANONICAL_NO_CHECKSUM = 0x01; /** Do not include a checksum */
-export const WALLY_MS_IS_DESCRIPTOR = 0x20; /** Contains only descriptor expressions (no miniscript) */
-export const WALLY_MS_IS_MULTIPATH = 0x02; /** Allows multiple paths via ``<a;b;c>`` */
-export const WALLY_MS_IS_PARENTED = 0x80; /** Contains at least one key key with a parent key origin */
-export const WALLY_MS_IS_PRIVATE = 0x04; /** Contains at least one private key */
-export const WALLY_MS_IS_RANGED = 0x01; /** Allows key ranges via ``*`` */
-export const WALLY_MS_IS_RAW = 0x10; /** Contains at least one raw key */
-export const WALLY_MS_IS_UNCOMPRESSED = 0x08; /** Contains at least one uncompressed key */
-export const WALLY_MS_IS_X_ONLY = 0x40; /** Contains at least one x-only key */
+export const WALLY_MS_IS_DESCRIPTOR = 0x020; /** Contains only descriptor expressions (no miniscript) */
+export const WALLY_MS_IS_ELEMENTS = 0x100; /** Contains Elements expressions or was parsed as Elements */
+export const WALLY_MS_IS_MULTIPATH = 0x002; /** Allows multiple paths via ``<a;b;c>`` */
+export const WALLY_MS_IS_PARENTED = 0x080; /** Contains at least one key key with a parent key origin */
+export const WALLY_MS_IS_PRIVATE = 0x004; /** Contains at least one private key */
+export const WALLY_MS_IS_RANGED = 0x001; /** Allows key ranges via ``*`` */
+export const WALLY_MS_IS_RAW = 0x010; /** Contains at least one raw key */
+export const WALLY_MS_IS_UNCOMPRESSED = 0x008; /** Contains at least one uncompressed key */
+export const WALLY_MS_IS_X_ONLY = 0x040; /** Contains at least one x-only key */
 export const WALLY_NETWORK_BITCOIN_MAINNET = 0x01; /** Bitcoin mainnet */
 export const WALLY_NETWORK_BITCOIN_REGTEST = 0xff ; /** Bitcoin regtest: Behaves as testnet except for segwit */
 export const WALLY_NETWORK_BITCOIN_TESTNET = 0x02; /** Bitcoin testnet */