Cryptographic Foundations of Blockchain

"""
Blockchain Cryptography — Python examples
Requires: pip install ecdsa web3 eth-account
"""
import hashlib, hmac, struct
from ecdsa import SigningKey, SECP256k1, util
from eth_account import Account
from web3 import Web3

# ── SHA-256 ─────────────────────────────────────────────────────────
def sha256(data: bytes) -> bytes:
    return hashlib.sha256(data).digest()

def sha256d(data: bytes) -> bytes:
    """Bitcoin-style double SHA-256"""
    return hashlib.sha256(hashlib.sha256(data).digest()).digest()

def keccak256(data: bytes) -> bytes:
    """Ethereum Keccak-256 (NOT the same as NIST SHA-3!)"""
    from Crypto.Hash import keccak
    k = keccak.new(digest_bits=256)
    k.update(data)
    return k.digest()

# Avalanche example
for msg in [b"hello", b"hello!", b"Hello"]:
    print(f"{msg!r:12s} -> {sha256(msg).hex()}")

# ── Merkle Tree ──────────────────────────────────────────────────────
class MerkleTree:
    def __init__(self, transactions: list[bytes]):
        self.leaves = [sha256d(tx) for tx in transactions]
        if len(self.leaves) % 2 == 1:
            self.leaves.append(self.leaves[-1])
        self.tree = self._build(self.leaves)

    def _build(self, level):
        if len(level) == 1:
            return [level]
        next_level = []
        for i in range(0, len(level), 2):
            next_level.append(sha256d(level[i] + level[i+1]))
        if len(next_level) % 2 == 1:
            next_level.append(next_level[-1])
        return [level] + self._build(next_level)

    @property
    def root(self) -> bytes:
        return self.tree[-1][0]

    def proof(self, leaf_index: int) -> list[tuple[bytes, str]]:
        """Returns list of (sibling_hash, 'left'|'right')"""
        proof = []
        idx = leaf_index
        for level in self.tree[:-1]:
            sib = idx ^ 1
            if sib < len(level):
                side = 'left' if sib < idx else 'right'
                proof.append((level[sib], side))
            idx //= 2
        return proof

    def verify(self, tx: bytes, proof: list, root: bytes) -> bool:
        h = sha256d(tx)
        for sibling, side in proof:
            if side == 'left':
                h = sha256d(sibling + h)
            else:
                h = sha256d(h + sibling)
        return h == root

txs = [b"tx0: Alice->Bob 1 BTC", b"tx1: Bob->Carol 0.5 BTC",
       b"tx2: Carol->Dave 0.3 BTC", b"tx3: Dave->Eve 0.1 BTC"]
mt = MerkleTree(txs)
print("Merkle root:", mt.root.hex())
proof = mt.proof(2)
assert mt.verify(txs[2], proof, mt.root), "proof failed!"
print("Proof for tx2 verified in", len(proof), "hashes")

# ── ECDSA with secp256k1 ─────────────────────────────────────────────
sk = SigningKey.generate(curve=SECP256k1)
vk = sk.get_verifying_key()

message = b"Transfer 1 BTC to Bob"
msg_hash = sha256d(message)

# Sign
sig = sk.sign_digest(msg_hash, sigencode=util.sigencode_der)
print("DER signature:", sig.hex())

# Verify
assert vk.verify_digest(sig, msg_hash, sigdecode=util.sigdecode_der)
print("Signature verified!")

# ── Ethereum address derivation ──────────────────────────────────────
# Using eth-account (which uses Keccak-256 correctly)
acct = Account.create()
print("Private key:", acct.key.hex())
print("Address:    ", acct.address)

# Manual derivation for illustration
import os
from eth_keys import keys

private_key_bytes = os.urandom(32)
pk = keys.PrivateKey(private_key_bytes)
pub = pk.public_key
pub_bytes = pub.to_bytes()        # 64 bytes, no 0x04 prefix
keccak_hash = Web3.keccak(pub_bytes)
address = "0x" + keccak_hash[-20:].hex()
print("Derived address:", address)

/**
 * Blockchain Cryptography — JavaScript examples
 * Uses the Web Crypto API (browser / Node >=15) and ethers.js
 */

// ── SHA-256 via Web Crypto ───────────────────────────────────────────
async function sha256(data) {
  // data: string or Uint8Array
  const bytes = typeof data === 'string'
    ? new TextEncoder().encode(data)
    : data;
  const buf = await crypto.subtle.digest('SHA-256', bytes);
  return new Uint8Array(buf);
}

async function sha256hex(str) {
  const hash = await sha256(str);
  return Array.from(hash).map(b => b.toString(16).padStart(2,'0')).join('');
}

// Avalanche demo
(async () => {
  for (const msg of ['hello', 'hello!', 'Hello']) {
    console.log(msg.padEnd(8), '->', await sha256hex(msg));
  }
})();

// ── Merkle Tree ──────────────────────────────────────────────────────
class MerkleTree {
  constructor(txHashes) {
    // txHashes: array of Uint8Array (already hashed leaves)
    let level = [...txHashes];
    if (level.length % 2 === 1) level.push(level[level.length - 1]);
    this.levels = [level];
    this._buildSync = false; // async build required
  }

  static async fromTransactions(txStrings) {
    const leaves = await Promise.all(
      txStrings.map(tx => sha256(tx))
    );
    return MerkleTree._build(leaves);
  }

  static async _build(leaves) {
    const tree = new MerkleTree(leaves);
    let current = tree.levels[0];
    while (current.length > 1) {
      const next = [];
      for (let i = 0; i < current.length; i += 2) {
        const pair = new Uint8Array([...current[i], ...current[i+1]]);
        next.push(await sha256(pair));
      }
      if (next.length % 2 === 1) next.push(next[next.length - 1]);
      tree.levels.push(next);
      current = next;
    }
    return tree;
  }

  get root() {
    return this.levels[this.levels.length - 1][0];
  }

  proof(leafIndex) {
    const proof = [];
    let idx = leafIndex;
    for (const level of this.levels.slice(0, -1)) {
      const sib = idx ^ 1;
      if (sib < level.length) {
        proof.push({ hash: level[sib], side: sib < idx ? 'left' : 'right' });
      }
      idx = Math.floor(idx / 2);
    }
    return proof;
  }

  static async verify(txBytes, proof, root) {
    let h = await sha256(txBytes);
    for (const { hash, side } of proof) {
      const pair = side === 'left'
        ? new Uint8Array([...hash, ...h])
        : new Uint8Array([...h, ...hash]);
      h = await sha256(pair);
    }
    return h.every((b, i) => b === root[i]);
  }
}

// ── Ethers.js wallet ─────────────────────────────────────────────────
// npm install ethers
import { ethers } from 'ethers';

// Create a random wallet
const wallet = ethers.Wallet.createRandom();
console.log('Mnemonic:    ', wallet.mnemonic.phrase);
console.log('Private key: ', wallet.privateKey);
console.log('Address:     ', wallet.address);

// Sign a message
const sig = await wallet.signMessage('Hello, blockchain!');
console.log('Signature:', sig);

// Recover address from signature
const recovered = ethers.verifyMessage('Hello, blockchain!', sig);
console.log('Recovered:', recovered); // should equal wallet.address

// HD wallet derivation (BIP-44 Ethereum)
const hdNode = ethers.HDNodeWallet.fromMnemonic(wallet.mnemonic);
const child = hdNode.derivePath("m/44'/60'/0'/0/0");
console.log('Child address:', child.address);

/*
 * Blockchain Cryptography — C examples
 * Compile: gcc -o blockchain_crypto blockchain_crypto.c -lssl -lcrypto
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/sha.h>
#include <openssl/evp.h>
#include <openssl/ec.h>
#include <openssl/ecdsa.h>
#include <openssl/obj_mac.h>

/* ── SHA-256 ──────────────────────────────────────────────────────── */
void sha256(const unsigned char *data, size_t len, unsigned char *out) {
    SHA256(data, len, out);
}

void sha256d(const unsigned char *data, size_t len, unsigned char *out) {
    unsigned char tmp[32];
    SHA256(data, len, tmp);
    SHA256(tmp, 32, out);
}

void print_hex(const unsigned char *data, size_t len) {
    for (size_t i = 0; i < len; i++) printf("%02x", data[i]);
    printf("\n");
}

/* ── Merkle Tree (4-leaf example) ────────────────────────────────── */
#define HASH_LEN 32

typedef struct {
    unsigned char hash[HASH_LEN];
} HashNode;

void merkle_parent(const HashNode *left, const HashNode *right, HashNode *out) {
    unsigned char combined[HASH_LEN * 2];
    memcpy(combined,           left->hash,  HASH_LEN);
    memcpy(combined + HASH_LEN, right->hash, HASH_LEN);
    sha256d(combined, HASH_LEN * 2, out->hash);
}

void compute_merkle_root(HashNode *leaves, int n, unsigned char *root_out) {
    if (n == 0) return;
    /* Copy to working array; duplicate last if odd */
    int sz = n + (n % 2);
    HashNode *level = calloc(sz, sizeof(HashNode));
    memcpy(level, leaves, n * sizeof(HashNode));
    if (n % 2) memcpy(&level[n], &level[n-1], sizeof(HashNode));

    while (sz > 1) {
        int next_sz = (sz + 1) / 2;
        HashNode *next = calloc(next_sz, sizeof(HashNode));
        for (int i = 0; i < sz; i += 2)
            merkle_parent(&level[i], &level[i+1], &next[i/2]);
        free(level);
        level = next;
        sz = next_sz;
    }
    memcpy(root_out, level[0].hash, HASH_LEN);
    free(level);
}

/* ── ECDSA (secp256k1) ───────────────────────────────────────────── */
void ecdsa_example(void) {
    /* Generate key pair on secp256k1 */
    EC_KEY *key = EC_KEY_new_by_curve_name(NID_secp256k1);
    if (!EC_KEY_generate_key(key)) { perror("keygen"); return; }

    const char *msg = "Transfer 1 BTC";
    unsigned char digest[32];
    sha256d((unsigned char*)msg, strlen(msg), digest);

    /* Sign */
    ECDSA_SIG *sig = ECDSA_do_sign(digest, 32, key);
    if (!sig) { perror("sign"); goto cleanup; }

    /* Verify */
    int ok = ECDSA_do_verify(digest, 32, sig, key);
    printf("ECDSA verify: %s\n", ok == 1 ? "VALID" : "INVALID");

    /* Print r and s */
    const BIGNUM *r, *s;
    ECDSA_SIG_get0(sig, &r, &s);
    printf("r = %s\n", BN_bn2hex(r));
    printf("s = %s\n", BN_bn2hex(s));

    ECDSA_SIG_free(sig);
cleanup:
    EC_KEY_free(key);
}

int main(void) {
    /* SHA-256 avalanche */
    const char *msgs[] = {"hello", "hello!", "Hello"};
    for (int i = 0; i < 3; i++) {
        unsigned char h[32];
        sha256((unsigned char*)msgs[i], strlen(msgs[i]), h);
        printf("%-8s -> ", msgs[i]);
        print_hex(h, 32);
    }
    /* Merkle root of 4 transactions */
    const char *txs[] = {"tx0", "tx1", "tx2", "tx3"};
    HashNode leaves[4];
    for (int i = 0; i < 4; i++)
        sha256d((unsigned char*)txs[i], strlen(txs[i]), leaves[i].hash);
    unsigned char root[32];
    compute_merkle_root(leaves, 4, root);
    printf("Merkle root -> "); print_hex(root, 32);

    ecdsa_example();
    return 0;
}

/*
 * Blockchain Cryptography — C++ examples
 * Compile: g++ -std=c++17 -o blockchain_crypto blockchain_crypto.cpp -lssl -lcrypto -lsecp256k1
 */
#include <iostream>
#include <vector>
#include <string>
#include <array>
#include <iomanip>
#include <sstream>
#include <openssl/sha.h>
#include <openssl/evp.h>
#include <secp256k1.h>

using Hash = std::array<uint8_t, 32>;

// ── SHA-256 ──────────────────────────────────────────────────────────
Hash sha256(const std::vector<uint8_t>& data) {
    Hash out;
    SHA256(data.data(), data.size(), out.data());
    return out;
}

Hash sha256d(const std::vector<uint8_t>& data) {
    auto h1 = sha256(data);
    std::vector<uint8_t> h1v(h1.begin(), h1.end());
    return sha256(h1v);
}

std::string toHex(const Hash& h) {
    std::ostringstream ss;
    for (auto b : h) ss << std::hex << std::setw(2) << std::setfill('0') << (int)b;
    return ss.str();
}

// ── Merkle Tree ──────────────────────────────────────────────────────
class MerkleTree {
public:
    explicit MerkleTree(const std::vector<std::string>& transactions) {
        std::vector<Hash> level;
        for (auto& tx : transactions) {
            std::vector<uint8_t> bytes(tx.begin(), tx.end());
            level.push_back(sha256d(bytes));
        }
        if (level.size() % 2 == 1) level.push_back(level.back());
        tree_.push_back(level);
        while (level.size() > 1) {
            std::vector<Hash> next;
            for (size_t i = 0; i < level.size(); i += 2) {
                std::vector<uint8_t> combined;
                combined.insert(combined.end(), level[i].begin(),   level[i].end());
                combined.insert(combined.end(), level[i+1].begin(), level[i+1].end());
                next.push_back(sha256d(combined));
            }
            if (next.size() % 2 == 1) next.push_back(next.back());
            tree_.push_back(next);
            level = next;
        }
    }

    Hash root() const { return tree_.back()[0]; }

    // proof: vector of (sibling_hash, is_right_sibling)
    std::vector<std::pair<Hash, bool>> proof(size_t idx) const {
        std::vector<std::pair<Hash, bool>> pf;
        for (size_t lvl = 0; lvl + 1 < tree_.size(); ++lvl) {
            size_t sib = idx ^ 1;
            if (sib < tree_[lvl].size())
                pf.push_back({tree_[lvl][sib], sib > idx});
            idx /= 2;
        }
        return pf;
    }

private:
    std::vector<std::vector<Hash>> tree_;
};

// ── secp256k1 ECDSA ──────────────────────────────────────────────────
void ecdsaExample() {
    secp256k1_context* ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);

    // Generate private key (in production: use /dev/urandom)
    uint8_t privkey[32] = {0};
    FILE* urandom = fopen("/dev/urandom", "rb");
    fread(privkey, 1, 32, urandom); fclose(urandom);

    // Derive public key
    secp256k1_pubkey pubkey;
    secp256k1_ec_pubkey_create(ctx, &pubkey, privkey);

    // Message hash
    std::string msg = "Transfer 1 BTC to Bob";
    std::vector<uint8_t> msgBytes(msg.begin(), msg.end());
    Hash msgHash = sha256d(msgBytes);

    // Sign
    secp256k1_ecdsa_signature sig;
    secp256k1_ecdsa_sign(ctx, &sig, msgHash.data(), privkey, nullptr, nullptr);

    // Verify
    int ok = secp256k1_ecdsa_verify(ctx, &sig, msgHash.data(), &pubkey);
    std::cout << "ECDSA verify: " << (ok ? "VALID" : "INVALID") << "\n";

    secp256k1_context_destroy(ctx);
}

int main() {
    // Avalanche
    for (auto msg : {"hello", "hello!", "Hello"}) {
        std::vector<uint8_t> b(msg, msg + strlen(msg));
        std::cout << std::setw(8) << std::left << msg << " -> " << toHex(sha256(b)) << "\n";
    }
    // Merkle tree
    MerkleTree mt({"tx0", "tx1", "tx2", "tx3"});
    std::cout << "Merkle root: " << toHex(mt.root()) << "\n";
    // ECDSA
    ecdsaExample();
    return 0;
}

/**
 * Blockchain Cryptography — Java examples
 * Dependencies: Bouncy Castle (bcprov-jdk18on)
 * Build: javac -cp bcprov-jdk18on-1.77.jar BlockchainCrypto.java
 */
import java.security.*;
import java.security.spec.*;
import java.util.*;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.jce.ECNamedCurveTable;
import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
import org.bouncycastle.crypto.params.*;
import org.bouncycastle.crypto.generators.ECKeyPairGenerator;
import org.bouncycastle.crypto.signers.ECDSASigner;
import org.bouncycastle.math.ec.ECPoint;
import java.math.BigInteger;

public class BlockchainCrypto {

    static { Security.addProvider(new BouncyCastleProvider()); }

    // ── SHA-256 ──────────────────────────────────────────────────────
    public static byte[] sha256(byte[] data) throws Exception {
        return MessageDigest.getInstance("SHA-256").digest(data);
    }

    public static byte[] sha256d(byte[] data) throws Exception {
        return sha256(sha256(data));
    }

    public static String toHex(byte[] bytes) {
        StringBuilder sb = new StringBuilder();
        for (byte b : bytes) sb.append(String.format("%02x", b));
        return sb.toString();
    }

    // ── Merkle Tree ──────────────────────────────────────────────────
    static class MerkleTree {
        private final List<List<byte[]>> levels = new ArrayList<>();

        public MerkleTree(List<byte[]> transactions) throws Exception {
            List<byte[]> leaves = new ArrayList<>();
            for (byte[] tx : transactions) leaves.add(sha256d(tx));
            if (leaves.size() % 2 == 1) leaves.add(leaves.get(leaves.size()-1));
            levels.add(leaves);
            List<byte[]> current = leaves;
            while (current.size() > 1) {
                List<byte[]> next = new ArrayList<>();
                for (int i = 0; i < current.size(); i += 2) {
                    byte[] combined = new byte[64];
                    System.arraycopy(current.get(i),   0, combined,  0, 32);
                    System.arraycopy(current.get(i+1), 0, combined, 32, 32);
                    next.add(sha256d(combined));
                }
                if (next.size() % 2 == 1) next.add(next.get(next.size()-1));
                levels.add(next);
                current = next;
            }
        }

        public byte[] root() { return levels.get(levels.size()-1).get(0); }

        public List<byte[]> proof(int leafIndex) {
            List<byte[]> pf = new ArrayList<>();
            int idx = leafIndex;
            for (int lvl = 0; lvl < levels.size()-1; lvl++) {
                int sib = idx ^ 1;
                List<byte[]> level = levels.get(lvl);
                if (sib < level.size()) pf.add(level.get(sib));
                idx /= 2;
            }
            return pf;
        }
    }

    // ── ECDSA with BouncyCastle ──────────────────────────────────────
    public static void ecdsaDemo() throws Exception {
        ECNamedCurveParameterSpec params = ECNamedCurveTable.getParameterSpec("secp256k1");
        ECDomainParameters domain = new ECDomainParameters(
            params.getCurve(), params.getG(), params.getN(), params.getH());

        // Generate key pair
        ECKeyPairGenerator gen = new ECKeyPairGenerator();
        gen.init(new ECKeyGenerationParameters(domain, new SecureRandom()));
        org.bouncycastle.crypto.AsymmetricCipherKeyPair kp = gen.generateKeyPair();
        ECPrivateKeyParameters privKey = (ECPrivateKeyParameters) kp.getPrivate();
        ECPublicKeyParameters  pubKey  = (ECPublicKeyParameters)  kp.getPublic();

        // Hash message
        byte[] msgHash = sha256d("Transfer 1 BTC to Bob".getBytes());

        // Sign
        ECDSASigner signer = new ECDSASigner();
        signer.init(true, privKey);
        BigInteger[] sig = signer.generateSignature(msgHash);
        System.out.println("r = " + sig[0].toString(16));
        System.out.println("s = " + sig[1].toString(16));

        // Verify
        signer.init(false, pubKey);
        boolean ok = signer.verifySignature(msgHash, sig[0], sig[1]);
        System.out.println("Verified: " + ok);
    }

    public static void main(String[] args) throws Exception {
        // Avalanche
        for (String msg : new String[]{"hello", "hello!", "Hello"}) {
            System.out.printf("%-8s -> %s%n", msg, toHex(sha256(msg.getBytes())));
        }
        // Merkle tree
        List<byte[]> txs = Arrays.asList(
            "tx0".getBytes(), "tx1".getBytes(), "tx2".getBytes(), "tx3".getBytes());
        MerkleTree mt = new MerkleTree(txs);
        System.out.println("Merkle root: " + toHex(mt.root()));
        System.out.println("Proof length for tx2: " + mt.proof(2).size() + " hashes");
        // ECDSA
        ecdsaDemo();
    }
}

// Blockchain Cryptography — Go examples
// go get github.com/ethereum/go-ethereum
package main

import (
	"crypto/ecdsa"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"math/big"

	gocrypto "github.com/ethereum/go-ethereum/crypto"
)

// ── SHA-256 ───────────────────────────────────────────────────────────
func Sha256(data []byte) []byte {
	h := sha256.Sum256(data)
	return h[:]
}

func Sha256d(data []byte) []byte {
	h := sha256.Sum256(data)
	h2 := sha256.Sum256(h[:])
	return h2[:]
}

// ── Merkle Tree ───────────────────────────────────────────────────────
type MerkleTree struct {
	Levels [][][]byte
}

func NewMerkleTree(txs [][]byte) *MerkleTree {
	leaves := make([][]byte, len(txs))
	for i, tx := range txs {
		leaves[i] = Sha256d(tx)
	}
	if len(leaves)%2 == 1 {
		leaves = append(leaves, leaves[len(leaves)-1])
	}
	tree := &MerkleTree{Levels: [][][]byte{leaves}}
	current := leaves
	for len(current) > 1 {
		var next [][]byte
		for i := 0; i+1 < len(current); i += 2 {
			combined := append(current[i], current[i+1]...)
			next = append(next, Sha256d(combined))
		}
		if len(next)%2 == 1 {
			next = append(next, next[len(next)-1])
		}
		tree.Levels = append(tree.Levels, next)
		current = next
	}
	return tree
}

func (m *MerkleTree) Root() []byte {
	return m.Levels[len(m.Levels)-1][0]
}

type ProofStep struct {
	Hash  []byte
	Right bool // true if sibling is to the right
}

func (m *MerkleTree) Proof(leafIdx int) []ProofStep {
	var proof []ProofStep
	idx := leafIdx
	for lvl := 0; lvl+1 < len(m.Levels); lvl++ {
		sib := idx ^ 1
		level := m.Levels[lvl]
		if sib < len(level) {
			proof = append(proof, ProofStep{Hash: level[sib], Right: sib > idx})
		}
		idx /= 2
	}
	return proof
}

func VerifyProof(tx []byte, proof []ProofStep, root []byte) bool {
	h := Sha256d(tx)
	for _, step := range proof {
		var combined []byte
		if step.Right {
			combined = append(h, step.Hash...)
		} else {
			combined = append(step.Hash, h...)
		}
		h = Sha256d(combined)
	}
	for i := range h {
		if h[i] != root[i] {
			return false
		}
	}
	return true
}

// ── ECDSA (go-ethereum) ───────────────────────────────────────────────
func ecdsaDemo() {
	// Generate private key on secp256k1
	privKey, err := gocrypto.GenerateKey()
	if err != nil {
		panic(err)
	}
	fmt.Printf("Private key: %x\n", privKey.D.Bytes())

	// Ethereum address = last 20 bytes of Keccak256(pubKey)
	addr := gocrypto.PubkeyToAddress(privKey.PublicKey)
	fmt.Printf("Address:     %s\n", addr.Hex())

	// Sign a message hash (must be 32 bytes)
	msgHash := gocrypto.Keccak256([]byte("Transfer 1 ETH to Bob"))
	sig, err := gocrypto.Sign(msgHash, privKey)
	if err != nil {
		panic(err)
	}
	fmt.Printf("Signature:   %x\n", sig)

	// Recover public key from signature (Ethereum-style)
	recoveredPub, err := gocrypto.SigToPub(msgHash, sig)
	if err != nil {
		panic(err)
	}
	recoveredAddr := gocrypto.PubkeyToAddress(*recoveredPub)
	fmt.Printf("Recovered:   %s\n", recoveredAddr.Hex())
	fmt.Printf("Match: %v\n", addr == recoveredAddr)
}

// ── secp256k1 ECDSA (stdlib, for illustration) ────────────────────────
func stdlibECDSA() {
	// Note: stdlib uses P-256 (not secp256k1); for secp256k1 use go-ethereum
	curve := gocrypto.S256() // secp256k1 via go-ethereum
	privKey, _ := ecdsa.GenerateKey(curve, rand.Reader)
	digest := Sha256d([]byte("hello blockchain"))
	r, s, _ := ecdsa.Sign(rand.Reader, privKey, digest)
	ok := ecdsa.Verify(&privKey.PublicKey, digest, r, s)
	fmt.Printf("stdlib ECDSA (secp256k1) verify: %v  r=%s\n",
		ok, hex.EncodeToString(r.Bytes()[:8]))
	_ = s
}

func main() {
	// Avalanche demo
	for _, msg := range []string{"hello", "hello!", "Hello"} {
		h := Sha256([]byte(msg))
		fmt.Printf("%-8s -> %s\n", msg, hex.EncodeToString(h))
	}

	// Merkle tree
	txs := [][]byte{[]byte("tx0"), []byte("tx1"), []byte("tx2"), []byte("tx3")}
	mt := NewMerkleTree(txs)
	fmt.Printf("Merkle root: %s\n", hex.EncodeToString(mt.Root()))
	proof := mt.Proof(2)
	ok := VerifyProof(txs[2], proof, mt.Root())
	fmt.Printf("Proof for tx2 verified: %v (len=%d)\n", ok, len(proof))

	// ECDSA
	ecdsaDemo()
	stdlibECDSA()
}