bip360: fix leafHashes order and a control byte in the pqc test vectors

[jeanpablojp]

Two fixes in bip-0360/ref-impl/common/tests/data/p2mr_pqc_construction.json, found while implementing BIP 360 against the published vectors.

First, the three-leaf vectors (p2mr_three_leaf_complex and p2mr_three_leaf_alternative) list intermediary.leafHashes with entries 0 and 2 swapped relative to the depth-first order of the script tree. The merkle root, scriptPubKey, address and control blocks in those same vectors all follow depth-first order, as do the equivalent trees in p2mr_construction.json. This looks like a leftover from the ordering problem that #2202 fixed for the control blocks.

Check against the spec formulas:

import json, hashlib

def tagged(tag, data):
    t = hashlib.sha256(tag.encode()).digest()
    return hashlib.sha256(t + t + data).digest()

d = json.load(open("p2mr_pqc_construction.json"))
tv = [t for t in d["test_vectors"] if t["id"] == "p2mr_three_leaf_complex"][0]
leaves = []
def walk(n):
    if isinstance(n, list):
        for x in n: walk(x)
    else: leaves.append(n)
walk(tv["given"]["scriptTree"])
for i, leaf in enumerate(leaves):
    s = bytes.fromhex(leaf["script"])
    h = tagged("TapLeaf", bytes([leaf["leafVersion"]]) + bytes([len(s)]) + s).hex()
    print(i, h == tv["intermediary"]["leafHashes"][i])

Before this change that prints "0 False / 1 True / 2 False", i.e. entries 0 and 2 hold each other's values. Same for p2mr_three_leaf_alternative.

Second, in p2mr_different_version_leaves the second leaf has "leafVersion": 250 (0xfa), but scriptPathControlBlocks[1] started with c1. The control byte carries the leaf version in its upper 7 bits with the low bit set, so it should be fb. The vector's leafHashes[1] and merkle root already correspond to the leaf hashed under 0xfa and the path bytes are correct, so only the first byte was wrong. As published, a spender using that control block would recompute the leaf hash under 0xc0 and fail the merkle check.

After both fixes every success vector in the file passes a full recomputation from the spec formulas: leaf hashes, merkle root, scriptPubKey, bech32m address, control blocks, and walking each control block path back to the root.

[jonatack]

Fixes LGTM (thanks!) pinging @cryptoquick @EthanHeilman for feedback or sign-off.

[cryptoquick]

Good changes. I'll make sure they're also reflected in our bindings vectors with this PR:

jbride/libbitcoinpqc-bindings#2