python-codex32 reference impl

[BenWestgate]

apoelstra/rust-codex32#2 (comment):

@BenWestgate if you have a rewrite feel free to open a PR -- if it's not too hard to review I'm happy to take it in.

But I think the correct direction to rewrite in is one where we add a rust-bech32 dependency, use that for all the checksumming and encoding stuff, and then here we add (a) utility methods, and (b) constructors and accessors for the id/threshold/share index.

I have wrote this python implementation that covers more tests than the rust one does. It also does the approach above and relies on general checksum and bech32 modules. So it also passes Bech32/Bech32m tests.

It includes new test vectors for bitcoin/bips#2040 and bitcoin/bips#2077.

From: https://github.com/BenWestgate/python-codex32

Published on PyPI: https://pypi.org/project/codex32/

[apoelstra]

I vote to merge this with a cursory review; later when I improve rust-codex32, I will steal all the test vectors from this implementation, and presumably if they pass on both implementations, they're both correct :P.

cursory review ACK 4857e18 -- checked that this is shaped like it does codex32 stuff, that there's nothing obviously malicious, no filesystem or network access, etc.

cc @roconnor-blockstream can you let me know if I should hold off on merging this? Fine to ping me out-of-band.

[BenWestgate]

I nACK 4857e18 because it allows encoding shares from padded bytes. When the padding is not uniform, independent random it can leak up to (k-1) * pad_len bits of secret to attackers with k-1 derived shares.

Comment explaining the problem: 4857e18#r198130738

The rust impl allows this too, and an issue was opened where a user of our libraries was confused he could not recover the same secret bytes from derived share bytes.

The best solution is refuse to encode or decode shares from/to bytes. Especially now that bitcoin/bips#2258 defines "S" decoding to be application specific.

I have some BIP0173 style test vectors in the bitcoin/bips#2040 (comment) that are worth stealing as well.