fix(kotlin-sdk): make identity-key repair ownership check HASH160-aware (dashpay#4183)

The repair path derived the KEYPAIR and required its public half to equal the
key's stored on-chain data before persisting. For ECDSA_HASH160 /
EDDSA_25519_HASH160 keys DPP stores the 20-byte HASH160 of the pubkey as that
data, not the pubkey, so the raw 33-vs-20-byte contentEquals could never match
and those key types were permanently un-repairable.

derivedPublicKeyMatches now takes the DPP key-type discriminant and HASH160s the
derived pubkey (RIPEMD160(SHA256)) before comparing for HASH160 types; every
other type keeps the plain content comparison. keyType is threaded through
PrivateKeyDeriver.deriveAndStore; the repair path reads it from the persisted
row's breadcrumbs, the store path passes it from the persist callback. Adds a
pure-Kotlin Hash160 helper (public bytes only — no derivation/secrets, within
the CLAUDE.md doctrine) pinned to RIPEMD-160 reference vectors, and tests
proving a HASH160-type key repairs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bfoss765

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/persistence/PlatformWalletPersistenceHandler.kt

@@ -1112,6 +1112,7 @@ class PlatformWalletPersistenceHandler(
                         publicKeyData = publicKeyData,
                         identityIndex = identityIndex,
                         keyIndex = keyIndex,
+                        keyType = keyType.toInt() and 0xFF,
                     )
                 }
                 val id = outcome.getOrNull()
@@ -2690,31 +2691,40 @@ class PlatformWalletPersistenceHandler(
                     "the key remains unusable and pending state is left intact",
             )
 
-        // BLOCKER 1: read the derivation indices from the persisted row, never
-        // from the caller. A row lacking breadcrumbs cannot be safely repaired
-        // (we would have to guess the slot), so fail WITHOUT clearing pending.
+        // BLOCKER 1: read the derivation indices (and the DPP key type, so the
+        // deriver's ownership check interprets publicKeyData correctly for
+        // HASH160-typed keys — dashpay/platform#4183 review) from the persisted
+        // row, never from the caller. A row lacking breadcrumbs cannot be
+        // safely repaired (we would have to guess the slot), so fail WITHOUT
+        // clearing pending.
         val breadcrumbs = database.publicKeyDao().getByPublicKeyData(publicKeyData)
             .firstNotNullOfOrNull { row ->
                 val identityIndex = row.derivationIdentityIndex
                 val keyIndex = row.derivationKeyIndex
-                if (identityIndex != null && keyIndex != null) identityIndex to keyIndex else null
+                if (identityIndex != null && keyIndex != null) {
+                    Triple(identityIndex, keyIndex, row.keyType.toIntOrNull() ?: 0)
+                } else {
+                    null
+                }
             } ?: throw DashSdkError.PlatformWallet.SigningKeyUnavailable(
                 "cannot repair identity key $pubkeyHex: no derivation breadcrumbs are " +
                     "persisted for it (derivationIdentityIndex/derivationKeyIndex are " +
                     "null) — the correct slot is unknown; pending state left intact",
             )
-        val (identityIndex, keyIndex) = breadcrumbs
+        val (identityIndex, keyIndex, keyType) = breadcrumbs
 
         // force = true routes through WalletStorage.replacePrivateKey and, in
         // the production deriver, derives the KEYPAIR and verifies the derived
-        // public key equals publicKeyData BEFORE any store — a mismatch throws
+        // public key equals publicKeyData (HASH160-hashed first for HASH160 key
+        // types) BEFORE any store — a mismatch throws
         // IdentityKeyDerivationMismatchException here, so nothing below runs
         // and pending is never cleared (BLOCKER 1).
         val storageIdentifier = deriver.deriveAndStore(
             walletId = walletId,
             publicKeyData = publicKeyData,
             identityIndex = identityIndex,
             keyIndex = keyIndex,
+            keyType = keyType,
             force = true,
         )?.identifier ?: return null
 
@@ -2928,8 +2938,17 @@ interface PrivateKeyDeriver {
      * Returns `null` if the key could not be derived/stored (leaving it
      * watch-only).
      *
-     * @param publicKeyData the compressed public-key bytes — used as the
+     * @param publicKeyData the on-chain public-key data — the compressed
+     *   pubkey, or the 20-byte HASH160 for a HASH160 key type — used as the
      *   storage key so the signer can locate the scalar.
+     * @param keyType the DPP `KeyType` discriminant of this key. Only the
+     *   [force] repair path consults it: it tells the pubkey-ownership check
+     *   whether [publicKeyData] is the raw derived pubkey or its HASH160, so a
+     *   HASH160-type key (`ECDSA_HASH160` = 2, `EDDSA_25519_HASH160` = 4) is
+     *   verified by hashing the derived pubkey rather than comparing raw bytes
+     *   that can never match (dashpay/platform#4183 review). Defaults to
+     *   `ECDSA_SECP256K1` (0) for the non-repair store path, which does no
+     *   pubkey comparison.
      * @param force when true, skip the "already usable" short-circuit and
      *   REPLACE the stored entry unconditionally — the repair path
      *   (dashpay/platform#4060 finding 6), where a shape+fingerprint-valid
@@ -2942,6 +2961,7 @@ interface PrivateKeyDeriver {
         publicKeyData: ByteArray,
         identityIndex: Int,
         keyIndex: Int,
+        keyType: Int = 0,
         force: Boolean = false,
     ): DerivedKeyStoreResult?
 

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/security/Hash160.kt

@@ -0,0 +1,152 @@
+package org.dashfoundation.dashsdk.security
+
+import java.security.MessageDigest
+
+/**
+ * Bitcoin/Dash **HASH160** — `RIPEMD160(SHA256(x))`, 20 bytes.
+ *
+ * ## Why this exists in the SDK
+ *
+ * A DPP identity key whose type is `ECDSA_HASH160` / `EDDSA_25519_HASH160`
+ * stores its on-chain "public key data" as the 20-byte HASH160 of the
+ * underlying public key, NOT the public key itself (rs-dpp `KeyType`;
+ * `IdentityPubkeyCodec` — "compressed pubkey, or 20-byte HASH160"). The
+ * identity-key repair path
+ * ([IdentityKeyPrivateKeyDeriver.derivedPublicKeyMatches]) must therefore
+ * hash the derived public key before comparing it to the stored value, or a
+ * HASH160-type key can NEVER be proven to match and repair fails forever
+ * (dashpay/platform#4183 review). This is the ownership check the reviewer
+ * asked for.
+ *
+ * ## Doctrine
+ *
+ * `packages/kotlin-sdk/CLAUDE.md` forbids **derivation**, **policy loops**,
+ * and **re-implementing protocol constants** in Kotlin. HASH160 is none of
+ * those: it hashes already-**public** bytes (no key material, no secret, no
+ * derivation-path logic) with two fully standardized, parameter-free digests.
+ * SHA-256 ships in the JDK; the JDK ships no RIPEMD-160 `MessageDigest`, so
+ * the standard public-domain RIPEMD-160 (Dobbertin/Bosselaers/Preneel,
+ * ISO/IEC 10118-3) is inlined below and pinned against reference vectors in
+ * `Hash160Test`. iOS computes the same value via the Rust
+ * `platform_wallet_hash160` FFI helper; swap this for a JNI-bridged call if
+ * one is ever exported.
+ *
+ * Pure + side-effect free so the repair's before-persistence identity check
+ * stays unit-testable without the native derive.
+ */
+internal object Hash160 {
+
+    /** HASH160 = RIPEMD160(SHA256([input])) — 20 bytes. */
+    fun hash160(input: ByteArray): ByteArray =
+        ripemd160(MessageDigest.getInstance("SHA-256").digest(input))
+
+    /** RIPEMD-160 of [input] — 20 bytes. */
+    fun ripemd160(input: ByteArray): ByteArray {
+        var h0 = 0x67452301
+        var h1 = 0xEFCDAB89.toInt()
+        var h2 = 0x98BADCFE.toInt()
+        var h3 = 0x10325476
+        var h4 = 0xC3D2E1F0.toInt()
+
+        // MD4-style padding: 0x80, zeros, then the 64-bit little-endian
+        // bit length, to a multiple of 64 bytes.
+        val bitLength = input.size.toLong() * 8
+        val paddedLength = ((input.size + 8) / 64 + 1) * 64
+        val padded = input.copyOf(paddedLength)
+        padded[input.size] = 0x80.toByte()
+        for (i in 0 until 8) {
+            padded[paddedLength - 8 + i] = (bitLength ushr (8 * i)).toByte()
+        }
+
+        val x = IntArray(16)
+        var offset = 0
+        while (offset < paddedLength) {
+            for (i in 0 until 16) {
+                val base = offset + 4 * i
+                x[i] = (padded[base].toInt() and 0xFF) or
+                    ((padded[base + 1].toInt() and 0xFF) shl 8) or
+                    ((padded[base + 2].toInt() and 0xFF) shl 16) or
+                    ((padded[base + 3].toInt() and 0xFF) shl 24)
+            }
+
+            var a = h0; var b = h1; var c = h2; var d = h3; var e = h4
+            var ap = h0; var bp = h1; var cp = h2; var dp = h3; var ep = h4
+
+            for (j in 0 until 80) {
+                val round = j / 16
+                var t = a + f(round, b, c, d) + x[R_LEFT[j]] + K_LEFT[round]
+                t = Integer.rotateLeft(t, S_LEFT[j]) + e
+                a = e; e = d; d = Integer.rotateLeft(c, 10); c = b; b = t
+
+                var tp = ap + f(4 - round, bp, cp, dp) + x[R_RIGHT[j]] + K_RIGHT[round]
+                tp = Integer.rotateLeft(tp, S_RIGHT[j]) + ep
+                ap = ep; ep = dp; dp = Integer.rotateLeft(cp, 10); cp = bp; bp = tp
+            }
+
+            val t = h1 + c + dp
+            h1 = h2 + d + ep
+            h2 = h3 + e + ap
+            h3 = h4 + a + bp
+            h4 = h0 + b + cp
+            h0 = t
+
+            offset += 64
+        }
+
+        val out = ByteArray(20)
+        intArrayOf(h0, h1, h2, h3, h4).forEachIndexed { i, word ->
+            for (bIdx in 0 until 4) {
+                out[4 * i + bIdx] = (word ushr (8 * bIdx)).toByte()
+            }
+        }
+        return out
+    }
+
+    /** The five round functions f1..f5, selected by round index 0..4. */
+    private fun f(round: Int, x: Int, y: Int, z: Int): Int = when (round) {
+        0 -> x xor y xor z
+        1 -> (x and y) or (x.inv() and z)
+        2 -> (x or y.inv()) xor z
+        3 -> (x and z) or (y and z.inv())
+        else -> x xor (y or z.inv())
+    }
+
+    private val K_LEFT = intArrayOf(
+        0x00000000, 0x5A827999, 0x6ED9EBA1, 0x8F1BBCDC.toInt(), 0xA953FD4E.toInt(),
+    )
+    private val K_RIGHT = intArrayOf(
+        0x50A28BE6, 0x5C4DD124, 0x6D703EF3, 0x7A6D76E9, 0x00000000,
+    )
+
+    // Message-word selection order, left and right lines.
+    private val R_LEFT = intArrayOf(
+        0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+        7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,
+        3, 10, 14, 4, 9, 15, 8, 1, 2, 7, 0, 6, 13, 11, 5, 12,
+        1, 9, 11, 10, 0, 8, 12, 4, 13, 3, 7, 15, 14, 5, 6, 2,
+        4, 0, 5, 9, 7, 12, 2, 10, 14, 1, 3, 8, 11, 6, 15, 13,
+    )
+    private val R_RIGHT = intArrayOf(
+        5, 14, 7, 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12,
+        6, 11, 3, 7, 0, 13, 5, 10, 14, 15, 8, 12, 4, 9, 1, 2,
+        15, 5, 1, 3, 7, 14, 6, 9, 11, 8, 12, 2, 10, 0, 4, 13,
+        8, 6, 4, 1, 3, 11, 15, 0, 5, 12, 2, 13, 9, 7, 10, 14,
+        12, 15, 10, 4, 1, 5, 8, 7, 6, 2, 13, 14, 0, 3, 9, 11,
+    )
+
+    // Per-step left-rotation amounts, left and right lines.
+    private val S_LEFT = intArrayOf(
+        11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8,
+        7, 6, 8, 13, 11, 9, 7, 15, 7, 12, 15, 9, 11, 7, 13, 12,
+        11, 13, 6, 7, 14, 9, 13, 15, 14, 8, 13, 6, 5, 12, 7, 5,
+        11, 12, 14, 15, 14, 15, 9, 8, 9, 14, 5, 6, 8, 6, 5, 12,
+        9, 15, 5, 11, 6, 8, 13, 12, 5, 12, 13, 14, 11, 8, 5, 6,
+    )
+    private val S_RIGHT = intArrayOf(
+        8, 9, 9, 11, 13, 15, 15, 5, 7, 7, 8, 11, 14, 14, 12, 6,
+        9, 13, 15, 7, 12, 8, 9, 11, 7, 7, 12, 7, 6, 15, 13, 11,
+        9, 7, 15, 11, 8, 6, 6, 14, 12, 13, 5, 14, 13, 13, 7, 5,
+        15, 5, 8, 11, 14, 14, 6, 14, 6, 9, 12, 9, 12, 5, 15, 8,
+        8, 5, 12, 9, 12, 5, 14, 6, 8, 13, 6, 5, 15, 13, 11, 11,
+    )
+}

packages/kotlin-sdk/sdk/src/main/kotlin/org/dashfoundation/dashsdk/security/IdentityKeyPrivateKeyDeriver.kt

@@ -50,6 +50,7 @@ class IdentityKeyPrivateKeyDeriver(
         publicKeyData: ByteArray,
         identityIndex: Int,
         keyIndex: Int,
+        keyType: Int,
         force: Boolean,
     ): DerivedKeyStoreResult {
         val pubkeyHex = publicKeyData.toHex()
@@ -102,7 +103,7 @@ class IdentityKeyPrivateKeyDeriver(
             val derivedPrivate = pair[0]
             val derivedPublic = pair[1]
             scalar = derivedPrivate
-            if (!derivedPublicKeyMatches(derivedPublic, publicKeyData)) {
+            if (!derivedPublicKeyMatches(derivedPublic, publicKeyData, keyType)) {
                 // Scrub the wrong scalar immediately; the finally scrubs
                 // again harmlessly (idempotent zero-fill).
                 derivedPrivate.fill(0)
@@ -164,17 +165,35 @@ class IdentityKeyPrivateKeyDeriver(
         /** Matches `WalletStorage`'s private `PRIVKEY_PREFIX`. */
         const val PRIVKEY_IDENTIFIER_PREFIX = "privkey."
 
+        /** DPP `KeyType` discriminants whose on-chain data is a HASH160. */
+        private const val KEY_TYPE_ECDSA_HASH160 = 2
+        private const val KEY_TYPE_EDDSA_25519_HASH160 = 4
+
         /**
-         * Whether a freshly derived public key [derived] is byte-for-byte the
-         * key [expected] a repair was asked to restore. Pure and side-effect
-         * free so the repair's before-persistence identity check
+         * Whether a freshly derived public key [derived] is the key [expected]
+         * a repair was asked to restore, interpreted per [keyType]. Pure and
+         * side-effect free so the repair's before-persistence identity check
          * (dashpay/platform#4060 blocker 1) is unit-testable without the
-         * native derive. Both halves are the compressed public-key bytes Rust
-         * emits (identical encoding on both derive entry points), so a plain
-         * content comparison is the whole check.
+         * native derive.
+         *
+         * [derived] is always the compressed public-key bytes Rust emits. What
+         * [expected] holds depends on the key type (dashpay/platform#4183
+         * review):
+         * - For `ECDSA_HASH160` / `EDDSA_25519_HASH160`, DPP stores the 20-byte
+         *   HASH160 of the public key as the key's on-chain data — NOT the key
+         *   itself — so we must HASH160 the derived pubkey before comparing.
+         *   A raw byte compare (33-byte pubkey vs 20-byte hash) can never
+         *   match, which made these key types permanently un-repairable before
+         *   this fix.
+         * - For every other key type the stored data IS the public key, so a
+         *   plain content comparison is the whole check.
          */
-        fun derivedPublicKeyMatches(derived: ByteArray, expected: ByteArray): Boolean =
-            derived.contentEquals(expected)
+        fun derivedPublicKeyMatches(derived: ByteArray, expected: ByteArray, keyType: Int): Boolean =
+            when (keyType) {
+                KEY_TYPE_ECDSA_HASH160, KEY_TYPE_EDDSA_25519_HASH160 ->
+                    Hash160.hash160(derived).contentEquals(expected)
+                else -> derived.contentEquals(expected)
+            }
     }
 }
 

packages/kotlin-sdk/sdk/src/test/kotlin/org/dashfoundation/dashsdk/persistence/PlatformWalletPersistenceHandlerTest.kt

@@ -779,6 +779,7 @@ class PlatformWalletPersistenceHandlerTest {
             publicKeyData: ByteArray,
             identityIndex: Int,
             keyIndex: Int,
+            keyType: Int,
             force: Boolean,
         ): DerivedKeyStoreResult? {
             calls.add(Triple(walletId, identityIndex, keyIndex))
@@ -1021,6 +1022,7 @@ class PlatformWalletPersistenceHandlerTest {
             publicKeyData: ByteArray,
             identityIndex: Int,
             keyIndex: Int,
+            keyType: Int,
             force: Boolean,
         ): DerivedKeyStoreResult = throw IllegalStateException("keystore unavailable")
 
@@ -1092,6 +1094,7 @@ class PlatformWalletPersistenceHandlerTest {
                 publicKeyData: ByteArray,
                 identityIndex: Int,
                 keyIndex: Int,
+                keyType: Int,
                 force: Boolean,
             ): DerivedKeyStoreResult =
                 if (boom) {
@@ -1199,6 +1202,7 @@ class PlatformWalletPersistenceHandlerTest {
                 publicKeyData: ByteArray,
                 identityIndex: Int,
                 keyIndex: Int,
+                keyType: Int,
                 force: Boolean,
             ): DerivedKeyStoreResult =
                 if (boom) {
@@ -1409,6 +1413,7 @@ class PlatformWalletPersistenceHandlerTest {
             publicKeyData: ByteArray,
             identityIndex: Int,
             keyIndex: Int,
+            keyType: Int,
             force: Boolean,
         ): DerivedKeyStoreResult? {
             if (!force) {

packages/kotlin-sdk/sdk/src/test/kotlin/org/dashfoundation/dashsdk/security/Hash160Test.kt

@@ -0,0 +1,58 @@
+package org.dashfoundation.dashsdk.security
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * Pins [Hash160] against the RIPEMD-160 reference vectors
+ * (Dobbertin/Bosselaers/Preneel) and the canonical Bitcoin/Dash HASH160 =
+ * `RIPEMD160(SHA256(pubkey))` composition DPP uses for `ECDSA_HASH160` /
+ * `EDDSA_25519_HASH160` identity keys. If this drifts, the identity-key
+ * repair ownership check for HASH160-typed keys (dashpay/platform#4183) would
+ * compare against a wrong hash and either wrongly reject a valid repair or
+ * (worse) wrongly accept a mismatched key.
+ */
+class Hash160Test {
+
+    private fun hex(bytes: ByteArray): String =
+        bytes.joinToString("") { "%02x".format(it) }
+
+    private fun unhex(s: String): ByteArray =
+        s.chunked(2).map { it.toInt(16).toByte() }.toByteArray()
+
+    @Test
+    fun ripemd160ReferenceVectors() {
+        assertEquals("9c1185a5c5e9fc54612808977ee8f548b2258d31", hex(Hash160.ripemd160(ByteArray(0))))
+        assertEquals("8eb208f7e05d987a9b044a8e98c6b087f15a0bfc", hex(Hash160.ripemd160("abc".toByteArray())))
+        assertEquals(
+            "5d0689ef49d2fae572b881b123a85ffa21595f36",
+            hex(Hash160.ripemd160("message digest".toByteArray())),
+        )
+        assertEquals(
+            "12a053384a9c0c88e405a06c27dcf49ada62eb2b",
+            hex(Hash160.ripemd160("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq".toByteArray())),
+        )
+    }
+
+    @Test
+    fun ripemd160MultiBlockAndMillionA() {
+        // 80 bytes — crosses the 64-byte block boundary.
+        assertEquals(
+            "9b752e45573d4b39f4dbd3323cab82bf63326bfb",
+            hex(Hash160.ripemd160("1234567890".repeat(8).toByteArray())),
+        )
+        assertEquals(
+            "52783243c1697bdbe16d37f97f68f08325dc1528",
+            hex(Hash160.ripemd160(ByteArray(1_000_000) { 'a'.code.toByte() })),
+        )
+    }
+
+    @Test
+    fun hash160OfKnownCompressedPubkey() {
+        // Canonical Bitcoin/Dash vector: the compressed secp256k1 pubkey for
+        // the classic sipa example private key. This is exactly the shape a
+        // HASH160-typed identity key stores on-chain as its "public key data".
+        val pubkey = unhex("0250863ad64a87ae8a2fe83c1af1a8403cb53f53e486d8511dad8a04887e5b2352")
+        assertEquals("f54a5851e9372b87810a8e60cdd2e7cfd80b6e31", hex(Hash160.hash160(pubkey)))
+    }
+}