feat: complete dashpay in platform wallet and swift example app

docs/dashpay/research/07-contactinfo-conventions.md

@@ -0,0 +1,88 @@
+# contactInfo wire conventions (research, 2026-06-12)
+
+Source-verified findings for implementing the DashPay `contactInfo`
+document (M3 task 13). Full citations at the bottom.
+
+## Decisive finding: no reference client implements contactInfo
+
+DashSync-iOS (`DSBlockchainIdentity.m` + Identity models), dashj /
+android-dpp / kotlin-platform, and dash-shared-core contain **zero**
+contactInfo creation or encryption code. DIP-15 + the deployed
+dashpay-contract schema are the only authoritative sources, and **this
+repo's implementation sets the de-facto wire convention.** There is no
+cross-client byte-compatibility constraint — only self-consistency and
+schema validity.
+
+## Conventions adopted (CONFIRMED unless marked INFERRED)
+
+### Key derivation (DIP-15)
+
+The "root encryption key" is the identity's **registered ENCRYPTION
+key** (DIP-11 purpose 1); `rootEncryptionKeyIndex` is that key's id on
+the identity. Two child keys are derived from its extended form in the
+owner's HD tree (hardened CKDpriv):
+
+```
+encToUserId key:  rootEncryptionKey / 65536' / derivationEncryptionKeyIndex'   (2^16)
+privateData key:  rootEncryptionKey / 65537' / derivationEncryptionKeyIndex'   (2^16 + 1)
+```
+
+The 2^16 offset is DIP-15's explicit "discount other potential
+derivations" choice. The AES-256 key is the raw 32-byte child private
+key scalar (INFERRED — no hash step is specified anywhere; matches how
+contactRequest ECDH consumes key material).
+
+`derivationEncryptionKeyIndex` is sequential per `$ownerId` starting at
+0 (one per contactInfo document; the unique index is
+`($ownerId, rootEncryptionKeyIndex, derivationEncryptionKeyIndex)`).
+
+### encToUserId (DIP-15, verbatim justification in the DIP)
+
+`AES-256-ECB(toUserId)` — exactly 32 bytes = two blocks, **no IV, no
+padding**. ECB is sound here because the plaintext is itself a SHA-256
+output and the key is never reused for other purposes.
+
+### privateData
+
+`IV(16) ‖ AES-256-CBC(plaintext)` — IV prepended (INFERRED from the
+`encryptedPublicKey` convention; DIP-15 doesn't state placement for
+this field).
+
+Plaintext: **CBOR array `[aliasName, note, displayHidden]`** per the
+deployed schema's field description — positional, with CBOR `null`
+for absent strings (INFERRED). NOTE: DIP-15 prose instead describes
+Bitcoin-varint "Dash message data" with extra `version` +
+`acceptedAccounts` fields; the deployed schema description wins (it is
+what any schema-reading client will expect). `version` /
+`acceptedAccounts` are NOT included — re-introducing them later means
+a versioned-CBOR convention change.
+
+### Privacy rule (DIP-15, spec-only — no client enforces it today)
+
+> "A client should not transmit a contact info document for a user to
+> the network until that user has at least two established contacts."
+
+Enforced at the publish gate: with <2 established contacts the local
+state still updates; the document write is deferred until the rule is
+satisfied.
+
+## Discrepancy table (DIP-15 prose vs deployed schema)
+
+| Question | DIP-15 prose | Deployed schema |
+|---|---|---|
+| Plaintext format | Bitcoin varint stream | CBOR array |
+| Fields | version, aliasName, note, displayHidden, acceptedAccounts | aliasName, note, displayHidden |
+| version | uInt32 present | absent |
+| acceptedAccounts | array of uInt32 | absent |
+
+## Sources
+
+- DIP-0015 (dashpay/dips) — derivation offsets, ECB/CBC modes, privacy rule
+- dashpay-contract `schema/v1/dashpay.schema.json` — CBOR-array description,
+  unique index, 48–2048B bounds
+- DIP-0011 (key purposes), DIP-0013 (identity key paths), DIP-0009
+  assignments (15'/16' are incoming-funds / auto-accept — no contactInfo path)
+- dashsync-iOS Identity models, android-dpp, kotlin-platform,
+  dash-shared-core — checked: no contactInfo implementation anywhere
+- rs-dpp `lib.rs` `RootEncryptionKeyIndex` / `DerivationEncryptionKeyIndex`
+  type aliases

packages/rs-platform-encryption/Cargo.toml

@@ -15,3 +15,6 @@ thiserror = "1.0"
 
 [dev-dependencies]
 hex = "0.4"
+# Tests use secp256k1's RNG helpers (`generate_keypair`, `secp256k1::rand`),
+# which are only available when dashcore's `rand` feature is enabled.
+dashcore = { workspace = true, features = ["rand"] }

packages/rs-platform-encryption/src/lib.rs

@@ -10,6 +10,16 @@ use dashcore::secp256k1::{PublicKey, SecretKey};
 type Aes256CbcEnc = cbc::Encryptor<Aes256>;
 type Aes256CbcDec = cbc::Decryptor<Aes256>;
 
+/// Length of the DIP-15 compact extended-public-key plaintext, in bytes.
+///
+/// `parentFingerprint(4) ‖ chainCode(32) ‖ publicKey(33)` = 69 bytes. This is
+/// the plaintext layout DIP-15 specifies for `encryptedPublicKey` and the form
+/// both reference clients (iOS dash-shared-core, Android dashj) emit and
+/// hard-check on receive. Encrypting exactly 69 bytes yields a 96-byte
+/// ciphertext (16-byte IV + 80-byte AES-256-CBC/PKCS7 block), matching the
+/// deployed contract's `minItems/maxItems: 96`.
+pub const COMPACT_XPUB_LEN: usize = 69;
+
 /// Derive a shared secret key using ECDH as specified in DIP-15
 ///
 /// This uses libsecp256k1_ecdh which computes: SHA256((y[31]&0x1|0x2) || x)
@@ -127,6 +137,66 @@ pub fn decrypt_extended_public_key(
     decrypt_aes_256_cbc(shared_key, &iv, ciphertext)
 }
 
+/// Assemble the DIP-15 compact extended-public-key plaintext.
+///
+/// Concatenates `parent_fingerprint ‖ chain_code ‖ pubkey` into the 69-byte
+/// compact form that DIP-15 defines for `encryptedPublicKey` (and that both
+/// reference clients emit). This is the plaintext that should be fed to
+/// [`encrypt_extended_public_key`] — *not* a BIP32/DIP-14 serialization, which
+/// carries extra version/depth/child-number metadata the wire format omits.
+///
+/// # Arguments
+/// * `parent_fingerprint` - 4-byte fingerprint of the parent key.
+/// * `chain_code` - 32-byte chain code of the shared (account) key.
+/// * `pubkey` - 33-byte compressed secp256k1 public key.
+///
+/// # Returns
+/// The 69-byte compact plaintext.
+pub fn compact_xpub_bytes(
+    parent_fingerprint: [u8; 4],
+    chain_code: [u8; 32],
+    pubkey: [u8; 33],
+) -> [u8; COMPACT_XPUB_LEN] {
+    let mut out = [0u8; COMPACT_XPUB_LEN];
+    out[0..4].copy_from_slice(&parent_fingerprint);
+    out[4..36].copy_from_slice(&chain_code);
+    out[36..69].copy_from_slice(&pubkey);
+    out
+}
+
+/// Parse a DIP-15 compact extended-public-key plaintext back into its
+/// three components.
+///
+/// Inverse of [`compact_xpub_bytes`]. Rejects any input whose length is not
+/// exactly [`COMPACT_XPUB_LEN`] (69) bytes — the reference clients hard-check
+/// this on receive, so a non-69-byte payload is not a valid DIP-15 compact
+/// xpub and must be handled separately (e.g. a legacy 78/107-byte BIP32/DIP-14
+/// serialization) by the caller.
+///
+/// # Arguments
+/// * `bytes` - The decrypted plaintext (must be exactly 69 bytes).
+///
+/// # Returns
+/// `(parent_fingerprint, chain_code, pubkey)` on success.
+///
+/// # Errors
+/// [`CryptoError::InvalidCompactXpubLength`] if `bytes.len() != 69`.
+#[allow(clippy::type_complexity)]
+pub fn parse_compact_xpub(bytes: &[u8]) -> Result<([u8; 4], [u8; 32], [u8; 33]), CryptoError> {
+    if bytes.len() != COMPACT_XPUB_LEN {
+        return Err(CryptoError::InvalidCompactXpubLength(bytes.len()));
+    }
+
+    let mut parent_fingerprint = [0u8; 4];
+    let mut chain_code = [0u8; 32];
+    let mut pubkey = [0u8; 33];
+    parent_fingerprint.copy_from_slice(&bytes[0..4]);
+    chain_code.copy_from_slice(&bytes[4..36]);
+    pubkey.copy_from_slice(&bytes[36..69]);
+
+    Ok((parent_fingerprint, chain_code, pubkey))
+}
+
 /// Encrypt an account label for DashPay (DIP-15)
 ///
 /// # Arguments
@@ -170,6 +240,60 @@ pub fn decrypt_account_label(
     String::from_utf8(decrypted).map_err(|_| CryptoError::InvalidUtf8)
 }
 
+/// Encrypt a 32-byte identity id with AES-256-ECB (DIP-15
+/// `contactInfo.encToUserId`).
+///
+/// Exactly two raw AES blocks — **no IV, no padding**. ECB is sound
+/// for this one field per DIP-15's own analysis: the plaintext is
+/// itself a SHA-256 output (pseudorandom, no repeated-block structure)
+/// and the key — a dedicated hardened child at
+/// `rootEncryptionKey/2^16'/index'` — is never reused for any other
+/// purpose. Do NOT use this for anything but `encToUserId`.
+pub fn encrypt_enc_to_user_id(key: &[u8; 32], to_user_id: &[u8; 32]) -> [u8; 32] {
+    use aes::cipher::{BlockEncrypt, KeyInit};
+
+    let cipher = Aes256::new(key.into());
+    let mut out = *to_user_id;
+    let (block1, block2) = out.split_at_mut(16);
+    cipher.encrypt_block(block1.into());
+    cipher.encrypt_block(block2.into());
+    out
+}
+
+/// Decrypt a 32-byte `contactInfo.encToUserId` ciphertext
+/// (inverse of [`encrypt_enc_to_user_id`]).
+pub fn decrypt_enc_to_user_id(key: &[u8; 32], ciphertext: &[u8; 32]) -> [u8; 32] {
+    use aes::cipher::{BlockDecrypt, KeyInit};
+
+    let cipher = Aes256::new(key.into());
+    let mut out = *ciphertext;
+    let (block1, block2) = out.split_at_mut(16);
+    cipher.decrypt_block(block1.into());
+    cipher.decrypt_block(block2.into());
+    out
+}
+
+/// Encrypt a `contactInfo.privateData` plaintext (CBOR bytes) as
+/// `IV(16) ‖ AES-256-CBC(plaintext)` — the same prepended-IV layout
+/// `encryptedPublicKey` uses (DIP-15 doesn't pin the layout for this
+/// field; research/07 adopts the convention).
+pub fn encrypt_private_data(key: &[u8; 32], iv: &[u8; 16], plaintext: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(16 + plaintext.len() + 16);
+    out.extend_from_slice(iv);
+    out.extend_from_slice(&encrypt_aes_256_cbc(key, iv, plaintext));
+    out
+}
+
+/// Decrypt a `contactInfo.privateData` blob (inverse of
+/// [`encrypt_private_data`]).
+pub fn decrypt_private_data(key: &[u8; 32], blob: &[u8]) -> Result<Vec<u8>, CryptoError> {
+    if blob.len() < 16 {
+        return Err(CryptoError::InvalidCiphertextLength);
+    }
+    let iv: [u8; 16] = blob[..16].try_into().expect("length checked above");
+    decrypt_aes_256_cbc(key, &iv, &blob[16..])
+}
+
 /// Errors that can occur during cryptographic operations
 #[derive(Debug, thiserror::Error)]
 pub enum CryptoError {
@@ -181,6 +305,9 @@ pub enum CryptoError {
 
     #[error("Invalid ciphertext length (must be at least 16 bytes for IV)")]
     InvalidCiphertextLength,
+
+    #[error("Invalid compact xpub length (DIP-15 requires exactly 69 bytes, got {0})")]
+    InvalidCompactXpubLength(usize),
 }
 
 #[cfg(test)]
@@ -232,8 +359,9 @@ mod tests {
         let mut iv = [0u8; 16];
         thread_rng().fill_bytes(&mut iv);
 
-        // Mock extended public key data (78 bytes)
-        let xpub_data = vec![0x04; 78];
+        // DIP-15 compact xpub plaintext (69 bytes). 69 → PKCS7 → 80, + 16-byte
+        // IV = exactly 96 bytes, matching the contract's minItems/maxItems: 96.
+        let xpub_data = vec![0x04; COMPACT_XPUB_LEN];
 
         // Encrypt and decrypt
         let encrypted = encrypt_extended_public_key(&shared_key, &iv, &xpub_data);
@@ -246,6 +374,66 @@ mod tests {
         assert_eq!(xpub_data, decrypted);
     }
 
+    #[test]
+    fn test_compact_xpub_round_trip() {
+        // Distinct byte patterns per field so a mis-sliced offset is caught.
+        let parent_fingerprint = [0x11u8, 0x22, 0x33, 0x44];
+        let chain_code = [0xAAu8; 32];
+        let mut pubkey = [0xBBu8; 33];
+        pubkey[0] = 0x02; // compressed-pubkey prefix
+
+        let compact = compact_xpub_bytes(parent_fingerprint, chain_code, pubkey);
+        assert_eq!(compact.len(), COMPACT_XPUB_LEN);
+        assert_eq!(compact.len(), 69);
+
+        // Byte-exact layout: fingerprint ‖ chaincode ‖ pubkey.
+        assert_eq!(&compact[0..4], &parent_fingerprint);
+        assert_eq!(&compact[4..36], &chain_code);
+        assert_eq!(&compact[36..69], &pubkey);
+
+        let (fp, cc, pk) = parse_compact_xpub(&compact).expect("parse 69-byte compact");
+        assert_eq!(fp, parent_fingerprint);
+        assert_eq!(cc, chain_code);
+        assert_eq!(pk, pubkey);
+    }
+
+    #[test]
+    fn test_encrypt_compact_xpub_is_exactly_96_bytes() {
+        // The whole point of the 69-byte compact form: it encrypts to exactly
+        // 96 bytes (16-byte IV + 80-byte AES-256-CBC/PKCS7), which is what the
+        // deployed contract enforces. A 107-byte DIP-14 serialization would
+        // yield 128 bytes and fail the contract's maxItems: 96.
+        let shared_key = [0x07u8; 32];
+        let iv = [0x09u8; 16];
+        let plaintext = [0xCDu8; COMPACT_XPUB_LEN];
+
+        let encrypted = encrypt_extended_public_key(&shared_key, &iv, &plaintext);
+        assert_eq!(
+            encrypted.len(),
+            96,
+            "69-byte compact plaintext must encrypt to exactly 96 bytes"
+        );
+
+        let decrypted = decrypt_extended_public_key(&shared_key, &encrypted).unwrap();
+        assert_eq!(&decrypted[..], &plaintext[..]);
+    }
+
+    #[test]
+    fn test_parse_compact_xpub_rejects_wrong_length() {
+        // Lengths that are NOT 69 must be rejected — including the legacy 78/107
+        // BIP32/DIP-14 serializations and the empty case.
+        for bad_len in [0usize, 36, 68, 70, 78, 107, 128] {
+            let bytes = vec![0u8; bad_len];
+            let err = parse_compact_xpub(&bytes).expect_err("non-69-byte input must be rejected");
+            assert!(
+                matches!(err, CryptoError::InvalidCompactXpubLength(n) if n == bad_len),
+                "expected InvalidCompactXpubLength({}), got {:?}",
+                bad_len,
+                err
+            );
+        }
+    }
+
     #[test]
     fn test_account_label_encryption() {
         let secp = Secp256k1::new();
@@ -276,3 +464,55 @@ mod tests {
         assert_eq!(label, decrypted);
     }
 }
+
+#[cfg(test)]
+mod contact_info_tests {
+    use super::*;
+
+    #[test]
+    fn enc_to_user_id_round_trips_and_is_two_independent_blocks() {
+        let key = [0x11u8; 32];
+        let mut id = [0u8; 32];
+        for (i, b) in id.iter_mut().enumerate() {
+            *b = i as u8;
+        }
+
+        let ct = encrypt_enc_to_user_id(&key, &id);
+        assert_ne!(ct, id, "ciphertext must differ from plaintext");
+        assert_eq!(decrypt_enc_to_user_id(&key, &ct), id, "round trip");
+
+        // ECB property we rely on: equal plaintext blocks → equal
+        // ciphertext blocks (sound here only because identity ids are
+        // hash outputs). This pins that the implementation really is
+        // ECB and not CBC-with-zero-IV.
+        let same_blocks = [0xAAu8; 32];
+        let ct2 = encrypt_enc_to_user_id(&key, &same_blocks);
+        assert_eq!(ct2[..16], ct2[16..], "ECB: identical blocks encrypt identically");
+
+        // Wrong key must not round-trip.
+        assert_ne!(decrypt_enc_to_user_id(&[0x22u8; 32], &ct), id);
+    }
+
+    #[test]
+    fn private_data_round_trips_with_prepended_iv() {
+        let key = [0x33u8; 32];
+        let iv = [0x44u8; 16];
+        // Minimal CBOR-ish payload; the schema floor is 48 bytes of
+        // ciphertext which IV(16) + one padded block satisfies — the
+        // length policy lives at the document-build layer, not here.
+        let plaintext = b"[\"alias\",\"note\",false] stand-in cbor";
+
+        let blob = encrypt_private_data(&key, &iv, plaintext);
+        assert_eq!(&blob[..16], &iv, "IV must be prepended verbatim");
+        assert!(blob.len() >= 48, "IV + padded CBC reaches the schema floor");
+
+        let plain = decrypt_private_data(&key, &blob).expect("decrypt");
+        assert_eq!(plain, plaintext);
+
+        // Truncated blob → typed error, not a panic.
+        assert!(matches!(
+            decrypt_private_data(&key, &blob[..10]),
+            Err(CryptoError::InvalidCiphertextLength)
+        ));
+    }
+}