Test vectors and reference implementation

slip-0010.md

-#SLIP-0010 : Universal private key derivation from master private key
+# SLIP-0010 : Universal private key derivation from master private key
 
 ```
 Number:  SLIP-0010
@@ -10,12 +10,12 @@ Authors: Pavol Rusnak <stick@satoshilabs.com>
 Created: 2015-12-25
 ```
 
-##Abstract
+## Abstract
 
 SLIP-0010 describes how to derive private and public key pairs for curve
 types different from secp256k1.
 
-##Motivation
+## Motivation
 
 Some Trezor applications, in particular SSH and GPG, need different
 curve types, e.g., NIST P-256 and ed25519.  For security reasons different
@@ -23,7 +23,7 @@ private and public key pairs should be used for these curves.  This SLIP
 describes how to derive a master private/public key for these curves and
 how a BIP-0032 like derivation is used.
 
-##Body
+## Body
 
 Trezor generates all keys from a 12 to 24 word mnemonic sequence and
 optionally a passphrase.  The BIP-0039 standard describes the procedure
@@ -33,7 +33,7 @@ similar and compatible to BIP-0032.  For other curves it uses a
 different salt than BIP-0032.  This avoids using the same private key
 for different elliptic curves with different orders.
 
-###Master key generation
+### Master key generation
 
 We adapt the master key generation from BIP-0032 to use a different
 key for different curve types.  To avoid invalid master keys, the
@@ -55,7 +55,7 @@ The supported curves are
 For ed25519, the last step always succeeds since every 256-bit number
 (even 0) is a valid private key.
 
-###Child key derivation (CKD) functions
+### Child key derivation (CKD) functions
 
 Private and public key derivation for NIST P-256 is identical to the
 generation for secp256k1 but uses the order of that curve as modulo.
@@ -69,7 +69,7 @@ on whether the child is a hardened key or not (or, equivalently,
 whether i ≥ 2<sup>31</sup>), and whether we're talking about private
 or public keys.
 
-####Private parent key &rarr; private child key
+#### Private parent key &rarr; private child key
 
 Let n denote the order of the curve.
 
@@ -88,7 +88,7 @@ The function CKDpriv((k<sub>par</sub>, c<sub>par</sub>), i) &rarr; (k<sub>i</sub
 
 The HMAC-SHA512 function is specified in [http://tools.ietf.org/html/rfc4231 RFC 4231].
 
-####Public parent key &rarr; public child key
+#### Public parent key &rarr; public child key
 
 This function always fails for ed25519 since normal derivation is not supported.
 
@@ -102,12 +102,237 @@ The function CKDpub((K<sub>par</sub>, c<sub>par</sub>), i) &rarr; (K<sub>i</sub>
 * In case parse<sub>256</sub>(I<sub>L</sub>) ≥ n or K<sub>i</sub> is the point at infinity, the resulting key is invalid.
   let I = HMAC-SHA512(Key = c<sub>par</sub>, Data = 0x01 || I<sub>R</sub> || ser<sub>32</sub>(i)) and restart at the third step.
 
-##Test vectors
+## Test vectors
 
-... to be included ...
+### Test vector 1 for secp256k1
+Seed (hex): 000102030405060708090a0b0c0d0e0f
+* Chain m
+    * fpr: 00000000
+    * chain: 873dff81c02f525623fd1fe5167eac3a55a049de3d314bb42ee227ffed37d508
+    * prv: e8f32e723decf4051aefac8e2c93c9c5b214313817cdb01a1494b917c8436b35
+    * pub: 0339a36013301597daef41fbe593a02cc513d0b55527ec2df1050e2e8ff49c85c2
+* Chain m/0<sub>H</sub>
+    * fpr: 3442193e
+    * chain: 47fdacbd0f1097043b78c63c20c34ef4ed9a111d980047ad16282c7ae6236141
+    * prv: edb2e14f9ee77d26dd93b4ecede8d16ed408ce149b6cd80b0715a2d911a0afea
+    * pub: 035a784662a4a20a65bf6aab9ae98a6c068a81c52e4b032c0fb5400c706cfccc56
+* Chain m/0<sub>H</sub>/1
+    * fpr: 5c1bd648
+    * chain: 2a7857631386ba23dacac34180dd1983734e444fdbf774041578e9b6adb37c19
+    * prv: 3c6cb8d0f6a264c91ea8b5030fadaa8e538b020f0a387421a12de9319dc93368
+    * pub: 03501e454bf00751f24b1b489aa925215d66af2234e3891c3b21a52bedb3cd711c
+* Chain m/0<sub>H</sub>/1/2<sub>H</sub>
+    * fpr: bef5a2f9
+    * chain: 04466b9cc8e161e966409ca52986c584f07e9dc81f735db683c3ff6ec7b1503f
+    * prv: cbce0d719ecf7431d88e6a89fa1483e02e35092af60c042b1df2ff59fa424dca
+    * pub: 0357bfe1e341d01c69fe5654309956cbea516822fba8a601743a012a7896ee8dc2
+* Chain m/0<sub>H</sub>/1/2<sub>H</sub>/2
+    * fpr: ee7ab90c
+    * chain: cfb71883f01676f587d023cc53a35bc7f88f724b1f8c2892ac1275ac822a3edd
+    * prv: 0f479245fb19a38a1954c5c7c0ebab2f9bdfd96a17563ef28a6a4b1a2a764ef4
+    * pub: 02e8445082a72f29b75ca48748a914df60622a609cacfce8ed0e35804560741d29
+* Chain m/0<sub>H</sub>/1/2<sub>H</sub>/2/1000000000
+    * fpr: d880d7d8
+    * chain: c783e67b921d2beb8f6b389cc646d7263b4145701dadd2161548a8b078e65e9e
+    * prv: 471b76e389e528d6de6d816857e012c5455051cad6660850e58372a6c3e6e7c8
+    * pub: 022a471424da5e657499d1ff51cb43c47481a03b1e77f951fe64cec9f5a48f7011
 
+### Test vector 1 for nist256p1
+Seed (hex): 000102030405060708090a0b0c0d0e0f
+* Chain m
+    * fpr: 00000000
+    * chain: beeb672fe4621673f722f38529c07392fecaa61015c80c34f29ce8b41b3cb6ea
+    * prv: 612091aaa12e22dd2abef664f8a01a82cae99ad7441b7ef8110424915c268bc2
+    * pub: 0266874dc6ade47b3ecd096745ca09bcd29638dd52c2c12117b11ed3e458cfa9e8
+* Chain m/0<sub>H</sub>
+    * fpr: be6105b5
+    * chain: 3460cea53e6a6bb5fb391eeef3237ffd8724bf0a40e94943c98b83825342ee11
+    * prv: 6939694369114c67917a182c59ddb8cafc3004e63ca5d3b84403ba8613debc0c
+    * pub: 0384610f5ecffe8fda089363a41f56a5c7ffc1d81b59a612d0d649b2d22355590c
+* Chain m/0<sub>H</sub>/1
+    * fpr: 9b02312f
+    * chain: 4187afff1aafa8445010097fb99d23aee9f599450c7bd140b6826ac22ba21d0c
+    * prv: 284e9d38d07d21e4e281b645089a94f4cf5a5a81369acf151a1c3a57f18b2129
+    * pub: 03526c63f8d0b4bbbf9c80df553fe66742df4676b241dabefdef67733e070f6844
+* Chain m/0<sub>H</sub>/1/2<sub>H</sub>
+    * fpr: b98005c1
+    * chain: 98c7514f562e64e74170cc3cf304ee1ce54d6b6da4f880f313e8204c2a185318
+    * prv: 694596e8a54f252c960eb771a3c41e7e32496d03b954aeb90f61635b8e092aa7
+    * pub: 0359cf160040778a4b14c5f4d7b76e327ccc8c4a6086dd9451b7482b5a4972dda0
+* Chain m/0<sub>H</sub>/1/2<sub>H</sub>/2
+    * fpr: 0e9f3274
+    * chain: ba96f776a5c3907d7fd48bde5620ee374d4acfd540378476019eab70790c63a0
+    * prv: 5996c37fd3dd2679039b23ed6f70b506c6b56b3cb5e424681fb0fa64caf82aaa
+    * pub: 029f871f4cb9e1c97f9f4de9ccd0d4a2f2a171110c61178f84430062230833ff20
+* Chain m/0<sub>H</sub>/1/2<sub>H</sub>/2/1000000000
+    * fpr: 8b2b5c4b
+    * chain: b9b7b82d326bb9cb5b5b121066feea4eb93d5241103c9e7a18aad40f1dde8059
+    * prv: 21c4f269ef0a5fd1badf47eeacebeeaa3de22eb8e5b0adcd0f27dd99d34d0119
+    * pub: 02216cd26d31147f72427a453c443ed2cde8a1e53c9cc44e5ddf739725413fe3f4
 
-##References
+### Test vector 1 for ed25519
+Seed (hex): 000102030405060708090a0b0c0d0e0f
+* Chain m
+    * fpr: 00000000
+    * chain: 90046a93de5380a72b5e45010748567d5ea02bbf6522f979e05c0d8d8ca9fffb
+    * prv: 2b4be7f19ee27bbf30c667b642d5f4aa69fd169872f8fc3059c08ebae2eb19e7
+    * pub: 00a4b2856bfec510abab89753fac1ac0e1112364e7d250545963f135f2a33188ed
+* Chain m/0<sub>H</sub>
+    * fpr: ddebc675
+    * chain: 8b59aa11380b624e81507a27fedda59fea6d0b779a778918a2fd3590e16e9c69
+    * prv: 68e0fe46dfb67e368c75379acec591dad19df3cde26e63b93a8e704f1dade7a3
+    * pub: 008c8a13df77a28f3445213a0f432fde644acaa215fc72dcdf300d5efaa85d350c
+* Chain m/0<sub>H</sub>/1<sub>H</sub>
+    * fpr: 13dab143
+    * chain: a320425f77d1b5c2505a6b1b27382b37368ee640e3557c315416801243552f14
+    * prv: b1d0bad404bf35da785a64ca1ac54b2617211d2777696fbffaf208f746ae84f2
+    * pub: 001932a5270f335bed617d5b935c80aedb1a35bd9fc1e31acafd5372c30f5c1187
+* Chain m/0<sub>H</sub>/1<sub>H</sub>/2<sub>H</sub>
+    * fpr: ebe4cb29
+    * chain: 2e69929e00b5ab250f49c3fb1c12f252de4fed2c1db88387094a0f8c4c9ccd6c
+    * prv: 92a5b23c0b8a99e37d07df3fb9966917f5d06e02ddbd909c7e184371463e9fc9
+    * pub: 00ae98736566d30ed0e9d2f4486a64bc95740d89c7db33f52121f8ea8f76ff0fc1
+* Chain m/0<sub>H</sub>/1<sub>H</sub>/2<sub>H</sub>/2<sub>H</sub>
+    * fpr: 316ec1c6
+    * chain: 8f6d87f93d750e0efccda017d662a1b31a266e4a6f5993b15f5c1f07f74dd5cc
+    * prv: 30d1dc7e5fc04c31219ab25a27ae00b50f6fd66622f6e9c913253d6511d1e662
+    * pub: 008abae2d66361c879b900d204ad2cc4984fa2aa344dd7ddc46007329ac76c429c
+* Chain m/0<sub>H</sub>/1<sub>H</sub>/2<sub>H</sub>/2<sub>H</sub>/1000000000<sub>H</sub>
+    * fpr: d6322ccd
+    * chain: 68789923a0cac2cd5a29172a475fe9e0fb14cd6adb5ad98a3fa70333e7afa230
+    * prv: 8f94d394a8e8fd6b1bc2f3f49f5c47e385281d5c17e65324b0f62483e37e8793
+    * pub: 003c24da049451555d51a7014a37337aa4e12d41e485abccfa46b47dfb2af54b7a
+
+### Test vector 2 for secp256k1
+Seed (hex): fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542
+* Chain m
+    * fpr: 00000000
+    * chain: 60499f801b896d83179a4374aeb7822aaeaceaa0db1f85ee3e904c4defbd9689
+    * prv: 4b03d6fc340455b363f51020ad3ecca4f0850280cf436c70c727923f6db46c3e
+    * pub: 03cbcaa9c98c877a26977d00825c956a238e8dddfbd322cce4f74b0b5bd6ace4a7
+* Chain m/0
+    * fpr: bd16bee5
+    * chain: f0909affaa7ee7abe5dd4e100598d4dc53cd709d5a5c2cac40e7412f232f7c9c
+    * prv: abe74a98f6c7eabee0428f53798f0ab8aa1bd37873999041703c742f15ac7e1e
+    * pub: 02fc9e5af0ac8d9b3cecfe2a888e2117ba3d089d8585886c9c826b6b22a98d12ea
+* Chain m/0/2147483647<sub>H</sub>
+    * fpr: 5a61ff8e
+    * chain: be17a268474a6bb9c61e1d720cf6215e2a88c5406c4aee7b38547f585c9a37d9
+    * prv: 877c779ad9687164e9c2f4f0f4ff0340814392330693ce95a58fe18fd52e6e93
+    * pub: 03c01e7425647bdefa82b12d9bad5e3e6865bee0502694b94ca58b666abc0a5c3b
+* Chain m/0/2147483647<sub>H</sub>/1
+    * fpr: d8ab4937
+    * chain: f366f48f1ea9f2d1d3fe958c95ca84ea18e4c4ddb9366c336c927eb246fb38cb
+    * prv: 704addf544a06e5ee4bea37098463c23613da32020d604506da8c0518e1da4b7
+    * pub: 03a7d1d856deb74c508e05031f9895dab54626251b3806e16b4bd12e781a7df5b9
+* Chain m/0/2147483647<sub>H</sub>/1/2147483646<sub>H</sub>
+    * fpr: 78412e3a
+    * chain: 637807030d55d01f9a0cb3a7839515d796bd07706386a6eddf06cc29a65a0e29
+    * prv: f1c7c871a54a804afe328b4c83a1c33b8e5ff48f5087273f04efa83b247d6a2d
+    * pub: 02d2b36900396c9282fa14628566582f206a5dd0bcc8d5e892611806cafb0301f0
+* Chain m/0/2147483647<sub>H</sub>/1/2147483646<sub>H</sub>/2
+    * fpr: 31a507b8
+    * chain: 9452b549be8cea3ecb7a84bec10dcfd94afe4d129ebfd3b3cb58eedf394ed271
+    * prv: bb7d39bdb83ecf58f2fd82b6d918341cbef428661ef01ab97c28a4842125ac23
+    * pub: 024d902e1a2fc7a8755ab5b694c575fce742c48d9ff192e63df5193e4c7afe1f9c
+
+### Test vector 2 for nist256p1
+Seed (hex): fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542
+* Chain m
+    * fpr: 00000000
+    * chain: 96cd4465a9644e31528eda3592aa35eb39a9527769ce1855beafc1b81055e75d
+    * prv: eaa31c2e46ca2962227cf21d73a7ef0ce8b31c756897521eb6c7b39796633357
+    * pub: 02c9e16154474b3ed5b38218bb0463e008f89ee03e62d22fdcc8014beab25b48fa
+* Chain m/0
+    * fpr: 607f628f
+    * chain: 84e9c258bb8557a40e0d041115b376dd55eda99c0042ce29e81ebe4efed9b86a
+    * prv: d7d065f63a62624888500cdb4f88b6d59c2927fee9e6d0cdff9cad555884df6e
+    * pub: 039b6df4bece7b6c81e2adfeea4bcf5c8c8a6e40ea7ffa3cf6e8494c61a1fc82cc
+* Chain m/0/2147483647<sub>H</sub>
+    * fpr: 946d2a54
+    * chain: f235b2bc5c04606ca9c30027a84f353acf4e4683edbd11f635d0dcc1cd106ea6
+    * prv: 96d2ec9316746a75e7793684ed01e3d51194d81a42a3276858a5b7376d4b94b9
+    * pub: 02f89c5deb1cae4fedc9905f98ae6cbf6cbab120d8cb85d5bd9a91a72f4c068c76
+* Chain m/0/2147483647<sub>H</sub>/1
+    * fpr: 218182d8
+    * chain: 7c0b833106235e452eba79d2bdd58d4086e663bc8cc55e9773d2b5eeda313f3b
+    * prv: 974f9096ea6873a915910e82b29d7c338542ccde39d2064d1cc228f371542bbc
+    * pub: 03abe0ad54c97c1d654c1852dfdc32d6d3e487e75fa16f0fd6304b9ceae4220c64
+* Chain m/0/2147483647<sub>H</sub>/1/2147483646<sub>H</sub>
+    * fpr: 931223e4
+    * chain: 5794e616eadaf33413aa309318a26ee0fd5163b70466de7a4512fd4b1a5c9e6a
+    * prv: da29649bbfaff095cd43819eda9a7be74236539a29094cd8336b07ed8d4eff63
+    * pub: 03cb8cb067d248691808cd6b5a5a06b48e34ebac4d965cba33e6dc46fe13d9b933
+* Chain m/0/2147483647<sub>H</sub>/1/2147483646<sub>H</sub>/2
+    * fpr: 956c4629
+    * chain: 3bfb29ee8ac4484f09db09c2079b520ea5616df7820f071a20320366fbe226a7
+    * prv: bb0a77ba01cc31d77205d51d08bd313b979a71ef4de9b062f8958297e746bd67
+    * pub: 020ee02e18967237cf62672983b253ee62fa4dd431f8243bfeccdf39dbe181387f
+
+### Test vector 2 for ed25519
+Seed (hex): fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542
+* Chain m
+    * fpr: 00000000
+    * chain: ef70a74db9c3a5af931b5fe73ed8e1a53464133654fd55e7a66f8570b8e33c3b
+    * prv: 171cb88b1b3c1db25add599712e36245d75bc65a1a5c9e18d76f9f2b1eab4012
+    * pub: 008fe9693f8fa62a4305a140b9764c5ee01e455963744fe18204b4fb948249308a
+* Chain m/0<sub>H</sub>
+    * fpr: 31981b50
+    * chain: 0b78a3226f915c082bf118f83618a618ab6dec793752624cbeb622acb562862d
+    * prv: 1559eb2bbec5790b0c65d8693e4d0875b1747f4970ae8b650486ed7470845635
+    * pub: 0086fab68dcb57aa196c77c5f264f215a112c22a912c10d123b0d03c3c28ef1037
+* Chain m/0<sub>H</sub>/2147483647<sub>H</sub>
+    * fpr: 1e9411b1
+    * chain: 138f0b2551bcafeca6ff2aa88ba8ed0ed8de070841f0c4ef0165df8181eaad7f
+    * prv: ea4f5bfe8694d8bb74b7b59404632fd5968b774ed545e810de9c32a4fb4192f4
+    * pub: 005ba3b9ac6e90e83effcd25ac4e58a1365a9e35a3d3ae5eb07b9e4d90bcf7506d
+* Chain m/0<sub>H</sub>/2147483647<sub>H</sub>/1<sub>H</sub>
+    * fpr: fcadf38c
+    * chain: 73bd9fff1cfbde33a1b846c27085f711c0fe2d66fd32e139d3ebc28e5a4a6b90
+    * prv: 3757c7577170179c7868353ada796c839135b3d30554bbb74a4b1e4a5a58505c
+    * pub: 002e66aa57069c86cc18249aecf5cb5a9cebbfd6fadeab056254763874a9352b45
+* Chain m/0<sub>H</sub>/2147483647<sub>H</sub>/1<sub>H</sub>/2147483646<sub>H</sub>
+    * fpr: aca70953
+    * chain: 0902fe8a29f9140480a00ef244bd183e8a13288e4412d8389d140aac1794825a
+    * prv: 5837736c89570de861ebc173b1086da4f505d4adb387c6a1b1342d5e4ac9ec72
+    * pub: 00e33c0f7d81d843c572275f287498e8d408654fdf0d1e065b84e2e6f157aab09b
+* Chain m/0<sub>H</sub>/2147483647<sub>H</sub>/1<sub>H</sub>/2147483646<sub>H</sub>/2<sub>H</sub>
+    * fpr: 422c654b
+    * chain: 5d70af781f3a37b829f0d060924d5e960bdc02e85423494afc0b1a41bbe196d4
+    * prv: 551d333177df541ad876a60ea71f00447931c0a9da16f227c11ea080d7391b8d
+    * pub: 0047150c75db263559a70d5778bf36abbab30fb061ad69f69ece61a72b0cfa4fc0
+
+### Test derivation retry for nist256p1
+Seed (hex): 000102030405060708090a0b0c0d0e0f
+* Chain m
+    * fpr: 00000000
+    * chain: beeb672fe4621673f722f38529c07392fecaa61015c80c34f29ce8b41b3cb6ea
+    * prv: 612091aaa12e22dd2abef664f8a01a82cae99ad7441b7ef8110424915c268bc2
+    * pub: 0266874dc6ade47b3ecd096745ca09bcd29638dd52c2c12117b11ed3e458cfa9e8
+* Chain m/28578<sub>H</sub>
+    * fpr: be6105b5
+    * chain: e94c8ebe30c2250a14713212f6449b20f3329105ea15b652ca5bdfc68f6c65c2
+    * prv: 06f0db126f023755d0b8d86d4591718a5210dd8d024e3e14b6159d63f53aa669
+    * pub: 02519b5554a4872e8c9c1c847115363051ec43e93400e030ba3c36b52a3e70a5b7
+* Chain m/28578<sub>H</sub>/33941
+    * fpr: 3e2b7bc6
+    * chain: 9e87fe95031f14736774cd82f25fd885065cb7c358c1edf813c72af535e83071
+    * prv: 092154eed4af83e078ff9b84322015aefe5769e31270f62c3f66c33888335f3a
+    * pub: 0235bfee614c0d5b2cae260000bb1d0d84b270099ad790022c1ae0b2e782efe120
+
+### Test seed retry for nist256p1
+Seed (hex): a7305bc8df8d0951f0cb224c0e95d7707cbdf2c6ce7e8d481fec69c7ff5e9446
+* Chain m
+    * fpr: 00000000
+    * chain: 7762f9729fed06121fd13f326884c82f59aa95c57ac492ce8c9654e60efd130c
+    * prv: 3b8c18469a4634517d6d0b65448f8e6c62091b45540a1743c5846be55d47d88f
+    * pub: 0383619fadcde31063d8c5cb00dbfe1713f3e6fa169d8541a798752a1c1ca0cb20
+
+## Implementation
+
+- [Python implementation to generate test vectors](slip-0010/testvectors.py)
+
+## References
 
 - [BIP-0032: Hierarchical Deterministic Wallets](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki)
 - [BIP-0039: Mnemonic code for generating deterministic keys](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki)

slip-0010/testvectors.py

+#!/usr/bin/env python2
+
+import binascii
+import hashlib
+import hmac
+import struct
+import ecdsa
+import ed25519
+from base58 import b58encode_check
+
+privdev = 0x80000000
+
+def int_to_string(x, pad):
+    result = ['\x00'] * pad
+    while x > 0:
+        pad -= 1
+        ordinal = x & 0xFF
+        result[pad] = (chr(ordinal))
+        x >>= 8
+    return ''.join(result)
+
+def string_to_int(s):
+    result = 0
+    for c in s:
+        if not isinstance(c, int):
+            c = ord(c)
+        result = (result << 8) + c
+    return result
+
+# mode 0 - compatible with BIP32 private derivation
+def seed2hdnode(seed, modifier, curve):
+    k = seed
+    while True:
+        h = hmac.new(modifier, seed, hashlib.sha512).digest()
+        key, chaincode = h[:32], h[32:]
+        a = string_to_int(key)
+        if (curve == 'ed25519'):
+            break
+        if (a < curve.order and a != 0):
+            break
+        seed = h
+        #print 'RETRY seed: ' + binascii.hexlify(seed)
+    return (key, chaincode)
+
+def fingerprint(publickey):
+    h = hashlib.new('ripemd160', hashlib.sha256(publickey).digest()).digest()
+    return h[:4]
+
+def b58xprv(parent_fingerprint, private_key, chain, depth, childnr):
+    raw = ('\x04\x88\xad\xe4' +
+              chr(depth) + parent_fingerprint + int_to_string(childnr, 4) +
+              chain + '\x00' + private_key)
+    return b58encode_check(raw)
+
+def b58xpub(parent_fingerprint, public_key, chain, depth, childnr):
+    raw = ('\x04\x88\xb2\x1e' +
+              chr(depth) + parent_fingerprint + int_to_string(childnr, 4) +
+              chain + public_key)
+    return b58encode_check(raw)
+
+def publickey(private_key, curve):
+    if curve == 'ed25519':
+        sk = ed25519.SigningKey(private_key)
+        return '\x00' + sk.get_verifying_key().to_bytes()
+    else:
+        Q = string_to_int(private_key) * curve.generator
+        xstr = int_to_string(Q.x(), 32)
+        parity = Q.y() & 1
+        return chr(2 + parity) + xstr
+
+def derive(parent_key, parent_chaincode, i, curve):
+    assert len(parent_key) == 32
+    assert len(parent_chaincode) == 32
+    k = parent_chaincode
+    if ((i & privdev) != 0):
+        key = '\x00' + parent_key
+    else:
+        key = publickey(parent_key, curve)
+    d = key + struct.pack('>L', i)
+    while True:
+        h = hmac.new(k, d, hashlib.sha512).digest()
+        key, chaincode = h[:32], h[32:]
+        if curve == 'ed25519':
+            break
+        #print 'I: ' + binascii.hexlify(h)
+        a = string_to_int(key)
+        key = (a + string_to_int(parent_key)) % curve.order
+        if (a < curve.order and key != 0):
+            key = int_to_string(key, 32)
+            break
+        d = '\x01' + h[32:] + struct.pack('>L', i)
+        #print 'a failed: ' + binascii.hexlify(h[:32])
+        #print 'RETRY: ' + binascii.hexlify(d)
+                        
+    return (key, chaincode)
+
+def get_curve_info(curvename):
+    if curvename == 'secp256k1':
+        return (ecdsa.curves.SECP256k1, 'Bitcoin seed') 
+    if curvename == 'nist256p1':
+        return (ecdsa.curves.NIST256p, 'Nist256p1 seed') 
+    if curvename == 'ed25519':
+        return ('ed25519', 'ed25519 seed')
+    raise BaseException('unsupported curve: '+curvename)
+
+def show_testvector(name, curvename, seedhex, derivationpath):
+    curve, seedmodifier = get_curve_info(curvename)
+    master_seed = binascii.unhexlify(seedhex)
+    k,c = seed2hdnode(master_seed, seedmodifier, curve)
+    p = publickey(k, curve)
+    fpr = '\x00\x00\x00\x00'
+    path = 'm'
+    print "### "+name+" for "+curvename
+    print "Seed (hex): " + seedhex
+    print '* Chain ' + path
+    print '    * fpr: ' + binascii.hexlify(fpr)
+    print '    * chain: ' + binascii.hexlify(c)
+    print '    * prv: ' + binascii.hexlify(k)
+    print '    * pub: ' + binascii.hexlify(p)
+    depth = 0
+    for i in derivationpath:
+        if curve == 'ed25519':
+            # no public derivation for ed25519
+            i = i | privdev
+        fpr = fingerprint(p)
+        depth = depth + 1
+        path = path + "/" + str(i & (privdev-1))
+        if ((i & privdev) != 0):
+            path = path + "<sub>H</sub>"
+        k,c = derive(k, c, i, curve)
+        p = publickey(k, curve) 
+        print '* Chain ' + path
+        print '    * fpr: ' + binascii.hexlify(fpr)
+        print '    * chain: ' + binascii.hexlify(c)
+        print '    * prv: ' + binascii.hexlify(k)
+        print '    * pub: ' + binascii.hexlify(p)
+        #print b58xprv(fpr, kc, cc, depth, i)
+        #print b58xpub(fpr, pc, cc, depth, i)
+    print
+
+def show_testvectors(name, curvenames, seedhex, derivationpath):
+    for curvename in curvenames:
+        show_testvector(name, curvename, seedhex, derivationpath)
+
+
+curvenames = ['secp256k1', 'nist256p1', 'ed25519'];
+        
+show_testvectors("Test vector 1", curvenames,
+                 '000102030405060708090a0b0c0d0e0f',
+                 [privdev + 0, 1, privdev + 2, 2, 1000000000])
+show_testvectors("Test vector 2", curvenames,
+                 'fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542',
+                 [0, privdev + 2147483647, 1, privdev + 2147483646, 2])
+            
+show_testvectors("Test derivation retry", ['nist256p1'],
+                 '000102030405060708090a0b0c0d0e0f',
+                 [privdev + 28578, 33941])
+
+show_testvectors("Test seed retry", ['nist256p1'],
+                 'a7305bc8df8d0951f0cb224c0e95d7707cbdf2c6ce7e8d481fec69c7ff5e9446',
+                 [])
+