Add SECP256k1/ECDSA support for transaction signing (#3861)

* Add SECP256k1/ECDSA support for transaction signing.

* Refactoring and fixes

* Fix for contracts

* Avoid breaking runtime host function

* Build fixes, make subkey work more generaically.

* Fix tests

* Dedpulicate a bit of code, remove unneeded code, docs

* Bump runtime version

* Fix a test and clean up some code.

* Derivation can derive seed.

* Whitespace

* Bump runtime again.

* Update core/primitives/src/crypto.rs

Co-Authored-By: Kian Paimani <5588131+kianenigma@users.noreply.github.com>

* Update core/primitives/src/ecdsa.rs

Co-Authored-By: Kian Paimani <5588131+kianenigma@users.noreply.github.com>

* Fix AppVerify

substrate/core/sr-io/src/lib.rs

@@ -220,15 +220,20 @@ export_api! {
 
 		/// Verify and recover a SECP256k1 ECDSA signature.
 		/// - `sig` is passed in RSV format. V should be either 0/1 or 27/28.
-		/// - returns `Err` if the signature is bad, otherwise the 64-byte pubkey (doesn't include the 0x04 prefix).
+		/// - returns `Err` if the signature is bad, otherwise the 64-byte raw pubkey (doesn't include the 0x04 prefix).
 		fn secp256k1_ecdsa_recover(sig: &[u8; 65], msg: &[u8; 32]) -> Result<[u8; 64], EcdsaVerifyError>;
+
+		/// Verify and recover a SECP256k1 ECDSA signature.
+		/// - `sig` is passed in RSV format. V should be either 0/1 or 27/28.
+		/// - returns `Err` if the signature is bad, otherwise the 33-byte compressed pubkey.
+		fn secp256k1_ecdsa_recover_compressed(sig: &[u8; 65], msg: &[u8; 32]) -> Result<[u8; 33], EcdsaVerifyError>;
 	}
 }
 
 export_api! {
 	pub(crate) trait HashingApi {
 		/// Conduct a 256-bit Keccak hash.
-		fn keccak_256(data: &[u8]) -> [u8; 32] ;
+		fn keccak_256(data: &[u8]) -> [u8; 32];
 
 		/// Conduct a 128-bit Blake2 hash.
 		fn blake2_128(data: &[u8]) -> [u8; 16];

substrate/core/sr-io/with_std.rs

@@ -300,6 +300,16 @@ impl CryptoApi for () {
 		res.copy_from_slice(&pubkey.serialize()[1..65]);
 		Ok(res)
 	}
+
+	fn secp256k1_ecdsa_recover_compressed(sig: &[u8; 65], msg: &[u8; 32]) -> Result<[u8; 33], EcdsaVerifyError> {
+		let rs = secp256k1::Signature::parse_slice(&sig[0..64])
+			.map_err(|_| EcdsaVerifyError::BadRS)?;
+		let v = secp256k1::RecoveryId::parse(if sig[64] > 26 { sig[64] - 27 } else { sig[64] } as u8)
+			.map_err(|_| EcdsaVerifyError::BadV)?;
+		let pubkey = secp256k1::recover(&secp256k1::Message::parse(msg), &rs, &v)
+			.map_err(|_| EcdsaVerifyError::BadSignature)?;
+		Ok(pubkey.serialize_compressed())
+	}
 }
 
 impl HashingApi for () {

substrate/core/sr-io/without_std.rs

@@ -394,12 +394,23 @@ pub mod ext {
 		) -> u32;
 
 		/// Note: ext_secp256k1_ecdsa_recover returns 0 if the signature is correct, nonzero otherwise.
+		///
+		/// pubkey_data must point to 64 bytes.
 		fn ext_secp256k1_ecdsa_recover(
 			msg_data: *const u8,
 			sig_data: *const u8,
 			pubkey_data: *mut u8,
 		) -> u32;
 
+		/// Note: ext_secp256k1_ecdsa_recover_compressed returns 0 if the signature is correct, nonzero otherwise.
+		///
+		/// pubkey_data must point to 33 bytes.
+		fn ext_secp256k1_ecdsa_recover_compressed(
+			msg_data: *const u8,
+			sig_data: *const u8,
+			pubkey_data: *mut u8,
+		) -> u32;
+
 		//================================
 		// Offchain-worker Context
 		//================================
@@ -971,6 +982,19 @@ impl CryptoApi for () {
 			_ => unreachable!("`ext_secp256k1_ecdsa_recover` only returns 0, 1, 2 or 3; qed"),
 		}
 	}
+
+	fn secp256k1_ecdsa_recover_compressed(sig: &[u8; 65], msg: &[u8; 32]) -> Result<[u8; 33], EcdsaVerifyError> {
+		let mut pubkey = [0u8; 33];
+		match unsafe {
+			ext_secp256k1_ecdsa_recover_compressed.get()(msg.as_ptr(), sig.as_ptr(), pubkey.as_mut_ptr())
+		} {
+			0 => Ok(pubkey),
+			1 => Err(EcdsaVerifyError::BadRS),
+			2 => Err(EcdsaVerifyError::BadV),
+			3 => Err(EcdsaVerifyError::BadSignature),
+			_ => unreachable!("`ext_secp256k1_ecdsa_recover_compressed` only returns 0, 1, 2 or 3; qed"),
+		}
+	}
 }
 
 impl OffchainApi for () {