feat: protocol additions for the firmware 7.x release (thorchain denom, ripple memo, hive, zcash)

messages-ethereum.options

@@ -1,2 +1,4 @@
 EthereumTxMetadata.signed_payload max_size:1024
 EthereumMetadataAck.display_summary max_size:32
+LoadClearsignSigner.pubkey max_size:33
+LoadClearsignSigner.alias max_size:32

messages-ethereum.proto

@@ -113,6 +113,22 @@ message EthereumMetadataAck {
 	optional string display_summary = 2;		// Brief result for host logging
 }
 
+/**
+ * Request: Load a clearsign signer public key + alias into a runtime key slot.
+ * The device shows a mandatory confirmation (alias + key fingerprint) before
+ * accepting; there is no way to load a signer without user consent. Loaded
+ * signers live in RAM only and are cleared on reboot. Every transaction whose
+ * metadata was verified by a loaded (non built-in) signer is preceded by a
+ * warning screen naming the alias during transaction confirmation.
+ * @next Success
+ * @next Failure
+ */
+message LoadClearsignSigner {
+	optional uint32 key_id = 1;		// target key slot (0-3); must not hold a built-in key
+	optional bytes pubkey = 2;		// 33-byte compressed secp256k1 public key
+	optional string alias = 3;		// short display name shown on load confirm + per-tx warning
+}
+
 ////////////////////////////////////////
 // Ethereum: Message signing messages //
 ////////////////////////////////////////

messages-hive.options

@@ -0,0 +1,46 @@
+HiveGetPublicKey.address_n              max_count:8
+
+HivePublicKey.public_key                max_size:64
+HivePublicKey.raw_public_key            max_size:33
+
+HiveGetPublicKeys.account_index         int_size:IS_32
+
+HivePublicKeys.owner_key                max_size:64
+HivePublicKeys.active_key               max_size:64
+HivePublicKeys.memo_key                 max_size:64
+HivePublicKeys.posting_key              max_size:64
+
+HiveSignTx.address_n                    max_count:8
+HiveSignTx.chain_id                     max_size:32
+HiveSignTx.from                         max_size:16
+HiveSignTx.to                           max_size:16
+HiveSignTx.amount                       int_size:IS_64
+HiveSignTx.asset_symbol                 max_size:10
+HiveSignTx.memo                         max_size:2048
+
+HiveSignedTx.signature                  max_size:65
+HiveSignedTx.serialized_tx              max_size:512
+
+HiveSignAccountCreate.address_n         max_count:8
+HiveSignAccountCreate.chain_id          max_size:32
+HiveSignAccountCreate.creator           max_size:16
+HiveSignAccountCreate.new_account_name  max_size:16
+HiveSignAccountCreate.owner_key         max_size:64
+HiveSignAccountCreate.active_key        max_size:64
+HiveSignAccountCreate.posting_key       max_size:64
+HiveSignAccountCreate.memo_key          max_size:64
+HiveSignAccountCreate.fee_amount        int_size:IS_64
+
+HiveSignedAccountCreate.signature       max_size:65
+HiveSignedAccountCreate.serialized_tx   max_size:512
+
+HiveSignAccountUpdate.address_n         max_count:8
+HiveSignAccountUpdate.chain_id          max_size:32
+HiveSignAccountUpdate.account           max_size:16
+HiveSignAccountUpdate.new_owner_key     max_size:64
+HiveSignAccountUpdate.new_active_key    max_size:64
+HiveSignAccountUpdate.new_posting_key   max_size:64
+HiveSignAccountUpdate.new_memo_key      max_size:64
+
+HiveSignedAccountUpdate.signature       max_size:65
+HiveSignedAccountUpdate.serialized_tx   max_size:512

messages-hive.proto

@@ -0,0 +1,149 @@
+syntax = "proto2";
+
+option java_package = "com.shapeshift.keepkey.lib.protobuf";
+option java_outer_classname = "KeepKeyMessageHive";
+
+/**
+ * Request: Ask device for a single Hive public key at a given SLIP-0048 path.
+ * Path format: m/48'/13'/role'/account'/0'
+ *   role: 0'=owner  1'=active  3'=memo  4'=posting
+ * @start
+ * @next HivePublicKey
+ * @next Failure
+ */
+message HiveGetPublicKey {
+    repeated uint32 address_n = 1;      // Full SLIP-0048 path (all 5 components hardened)
+    optional bool   show_display = 2;   // Confirm on device before returning
+    optional uint32 role = 3;           // 0=owner 1=active 3=memo 4=posting (for display label only)
+}
+
+/**
+ * Response: Single Hive public key
+ * @end
+ */
+message HivePublicKey {
+    optional string public_key     = 1; // STM-prefixed base58check public key
+    optional bytes  raw_public_key = 2; // 33-byte compressed secp256k1 public key
+}
+
+/**
+ * Request: Ask device for all four Hive role keys in one interaction.
+ * Derives owner/active/memo/posting keys for the given account index.
+ * Paths:
+ *   owner:   m/48'/13'/0'/account_index'/0'
+ *   active:  m/48'/13'/1'/account_index'/0'
+ *   memo:    m/48'/13'/3'/account_index'/0'
+ *   posting: m/48'/13'/4'/account_index'/0'
+ * @start
+ * @next HivePublicKeys
+ * @next Failure
+ */
+message HiveGetPublicKeys {
+    optional uint32 account_index = 1 [default = 0]; // Hive account slot (0 = first account)
+    optional bool   show_display  = 2;               // Confirm on device before returning
+}
+
+/**
+ * Response: All four Hive role public keys
+ * @end
+ */
+message HivePublicKeys {
+    optional string owner_key   = 1;   // STM... owner public key
+    optional string active_key  = 2;   // STM... active public key
+    optional string memo_key    = 3;   // STM... memo public key
+    optional string posting_key = 4;   // STM... posting public key
+}
+
+/**
+ * Request: Sign a Hive transfer transaction (op type 2).
+ * Signing key should be the active key: m/48'/13'/1'/account'/0'
+ * @start
+ * @next HiveSignedTx
+ * @next Failure
+ */
+message HiveSignTx {
+    repeated uint32 address_n       = 1;  // Full SLIP-0048 path of signing key
+    optional bytes  chain_id        = 2;  // 32-byte chain ID (mainnet = beeab0de...)
+    optional uint32 ref_block_num   = 3;  // Reference block number (uint16)
+    optional uint32 ref_block_prefix = 4; // Reference block prefix (uint32)
+    optional uint32 expiration      = 5;  // Expiration Unix timestamp (uint32)
+    optional string from            = 6;  // Sender account name
+    optional string to              = 7;  // Recipient account name
+    optional uint64 amount          = 8;  // Amount in milliHIVE (1000 = 1.000 HIVE)
+    optional uint32 decimals        = 9;  // Decimal places (3 for HIVE/HBD)
+    optional string asset_symbol    = 10; // "HIVE" or "HBD"
+    optional string memo            = 11; // Optional transfer memo
+}
+
+/**
+ * Response: Signed Hive transfer transaction
+ * @end
+ */
+message HiveSignedTx {
+    optional bytes signature     = 1;    // 65-byte recoverable secp256k1 signature
+    optional bytes serialized_tx = 2;    // Serialized Graphene transaction bytes
+}
+
+/**
+ * Request: Sign a Hive account_create operation (op type 9).
+ * All four role public keys become the account authorities at genesis.
+ * No software keys are generated. KeepKey is sole root of trust from block 1.
+ * Signing key: owner key at m/48'/13'/0'/account_index'/0'
+ * @start
+ * @next HiveSignedAccountCreate
+ * @next Failure
+ */
+message HiveSignAccountCreate {
+    repeated uint32 address_n        = 1;  // Owner key path (m/48'/13'/0'/account'/0')
+    optional bytes  chain_id         = 2;  // 32-byte chain ID
+    optional uint32 ref_block_num    = 3;
+    optional uint32 ref_block_prefix = 4;
+    optional uint32 expiration       = 5;
+    optional string creator          = 6;  // Pioneer sponsor account name
+    optional string new_account_name = 7;  // Desired Hive username
+    optional string owner_key        = 8;  // STM... owner public key (from device)
+    optional string active_key       = 9;  // STM... active public key (from device)
+    optional string posting_key      = 10; // STM... posting public key (from device)
+    optional string memo_key         = 11; // STM... memo public key (from device)
+    optional uint64 fee_amount       = 12; // Creation fee in milliHIVE (3000 = 3.000 HIVE)
+}
+
+/**
+ * Response: Signed Hive account_create transaction
+ * @end
+ */
+message HiveSignedAccountCreate {
+    optional bytes signature     = 1;    // 65-byte recoverable signature
+    optional bytes serialized_tx = 2;    // Serialized Graphene transaction bytes
+}
+
+/**
+ * Request: Sign a Hive account_update operation (op type 10).
+ * Replaces all account authorities with KeepKey-derived keys.
+ * Used to secure an existing Hive account.
+ * Signing key: owner key at m/48'/13'/0'/account_index'/0'
+ * @start
+ * @next HiveSignedAccountUpdate
+ * @next Failure
+ */
+message HiveSignAccountUpdate {
+    repeated uint32 address_n        = 1;  // Owner key path (must match account's current owner)
+    optional bytes  chain_id         = 2;  // 32-byte chain ID
+    optional uint32 ref_block_num    = 3;
+    optional uint32 ref_block_prefix = 4;
+    optional uint32 expiration       = 5;
+    optional string account          = 6;  // Hive account name to update
+    optional string new_owner_key    = 7;  // STM... new owner public key
+    optional string new_active_key   = 8;  // STM... new active public key
+    optional string new_posting_key  = 9;  // STM... new posting public key
+    optional string new_memo_key     = 10; // STM... new memo public key
+}
+
+/**
+ * Response: Signed Hive account_update transaction
+ * @end
+ */
+message HiveSignedAccountUpdate {
+    optional bytes signature     = 1;    // 65-byte recoverable signature
+    optional bytes serialized_tx = 2;    // Serialized Graphene transaction bytes
+}

messages-ripple.proto

@@ -34,6 +34,7 @@ message RippleSignTx {
 	optional uint32 sequence = 4;				// transaction sequence number
 	optional uint32 last_ledger_sequence = 5;	// see https://developers.ripple.com/reliable-transaction-submission.html#lastledgersequence
 	optional RipplePayment payment = 6;			// Payment transaction type
+	optional string memo = 7;					// transaction memo (e.g. THORChain swap routing memo)
 }
 
 /**

messages-thorchain.proto

@@ -60,6 +60,7 @@ message ThorchainMsgSend {
     optional uint64 amount = 8 [jstype = JS_STRING];
     optional OutputAddressType address_type = 9;
     reserved 10;
+    optional string denom = 11;         // asset denom, e.g. "rune" or IBC denom
 }
 
 message ThorchainMsgDeposit {

messages-zcash.options

@@ -5,6 +5,7 @@ ZcashSignPCZT.transparent_digest max_size:32
 ZcashSignPCZT.sapling_digest max_size:32
 ZcashSignPCZT.orchard_digest max_size:32
 ZcashSignPCZT.orchard_anchor max_size:32
+ZcashSignPCZT.expected_seed_fingerprint max_size:32
 
 ZcashPCZTAction.alpha max_size:32
 ZcashPCZTAction.sighash max_size:32
@@ -17,6 +18,8 @@ ZcashPCZTAction.enc_memo max_size:512
 ZcashPCZTAction.enc_noncompact max_size:612
 ZcashPCZTAction.rk max_size:32
 ZcashPCZTAction.out_ciphertext max_size:80
+ZcashPCZTAction.recipient max_size:43
+ZcashPCZTAction.rseed max_size:32
 
 ZcashSignedPCZT.signatures max_count:64 max_size:64
 ZcashSignedPCZT.txid max_size:32
@@ -26,16 +29,19 @@ ZcashGetOrchardFVK.address_n max_count:8
 ZcashOrchardFVK.ak max_size:32
 ZcashOrchardFVK.nk max_size:32
 ZcashOrchardFVK.rivk max_size:32
+ZcashOrchardFVK.seed_fingerprint max_size:32
+
+ZcashTransparentOutput.script_pubkey max_size:128
 
 ZcashTransparentInput.sighash max_size:32
 ZcashTransparentInput.address_n max_count:8
+ZcashTransparentInput.prevout_txid max_size:32
+ZcashTransparentInput.script_pubkey max_size:128
 
-ZcashTransparentSig.signature max_size:73
+ZcashTransparentSigned.signatures max_count:8 max_size:73
 
 ZcashDisplayAddress.address_n max_count:8
-ZcashDisplayAddress.address max_size:256
-ZcashDisplayAddress.ak max_size:32
-ZcashDisplayAddress.nk max_size:32
-ZcashDisplayAddress.rivk max_size:32
+ZcashDisplayAddress.expected_seed_fingerprint max_size:32
 
 ZcashAddress.address max_size:256
+ZcashAddress.seed_fingerprint max_size:32