Module hashlock 

The hashlock preimage derivation (SPEC_ms_hashlock §2).

THE RULE LIVES HERE, in the codec, beside the kind that carries its output: one crate, one corpus, one SHA pin, one provenance pin for the Go port. ms hashlock is a thin verb over these four functions.

Two methods, the operator’s choice (brainstorm L5): preimage_hardened is PBKDF2-HMAC-SHA256 with a fixed salt, 100,000 iterations and dkLen 32 (L4); preimage_sha256 is one SHA-256 of the phrase bytes. Both take the phrase as BYTES, exactly as given – no trimming, folding or normalising happens here or in any caller (§4.3). digest is SHA-256 of X, the value the policy carries; it is public the moment the policy is engraved and is therefore NOT zeroized.

THE SALT IS FIXED AND HAS NO PARAMETER (L13). Changing it after any vector ships is a new method, not a tweak: every engraved policy’s preimage was derived under this exact byte string.

Enums

PhraseRefusal

Why a phrase was refused. One variant per rule, in the order the rule checks them; the CALLER renders the sentence.

Constants

HASHLOCK_DKLEN

Derived-key length: a miniscript sha256(H) preimage is exactly 32 bytes.

HASHLOCK_ITERATIONS

PBKDF2 iteration count – the operator’s cap, chosen so a signer at a tenth of the SH2’s measured rate still derives in reasonable time.

HASHLOCK_PHRASE_MAX_CHARS

The phrase cap. Its own constant on each side, lockstep-pinned; NOT the device’s plate-legibility passphrase.MaxLen.

HASHLOCK_SALT

The fixed salt (ASCII, copyable by hand, domain-separated from BIP-39’s "mnemonic" and from me’s 16-byte random seal salt).

Functions

digest

H = SHA-256(X): what the policy carries and the plate shows. Public.

looks_like_ms1

looks_like_ms1 over the NORMALISED token: trimmed, ASCII-lowercased, display separators (whitespace, -, ,) stripped, then at least 48 characters, an ms1 prefix and only bech32 characters.

preimage_hardened

X = PBKDF2-HMAC-SHA256(phrase, HASHLOCK_SALT, HASHLOCK_ITERATIONS, 32).

preimage_random

X from the OS CSPRNG, failing closed: an error, never a zeroed buffer. Lives here rather than in the CLI so the whole preimage surface – and its randomness contract – is one crate’s (R0 r0 correctness I-2).

preimage_sha256

X = SHA-256(phrase). The brainwallet construction; the CLI warns on it at every length (L12) and this function does not judge.

qr_text

The QR text a hashlock PHRASE plate carries (SPEC_hashlock_H6 §8.6), byte for byte: three labelled lines, LF-separated, NO trailing newline, the phrase LAST.

validate_phrase

The rule. ORDER MATTERS and is the spec’s: empty, printable ASCII, ms1-shape (BEFORE the cap, so a grouped plate string gets the --in remedy and not “too long”), the cap, 64-hex.