Wallet private key derivation is brittle

[AaronFeickert]

Wallet key derivation relies on concatenation of seed entropy, a variable-length branch string, and an index. These values are hashed after concatenation using SHA-256, and parsed as a private key.

This approach is brittle:

• The concatenation can collide on distinct inputs, since arbitrary-length branch strings are allowed and the key index is not subject to a fixed-length (or even platform-independent) encoding
• The hash instantiation is not domain separated, which is unsafe if the inputs (or parts of them) are used elsewhere; it is therefore unsuitable as a key derivation function

The following are recommended:

• Use a modern key derivation function like Blake2b or Blake3
• Prepend the branch string length (where this length is itself in a fixed-length encoding) when encoding it as hash input
• Use a fixed-length and platform-independent encoding for the key index

Any future hashing API should be considered when addressing this issue.

[jorgeantonio21]

A possible approach to this issue can be found here. We make use of the current hashing API, for proper domain separation. Moreover, current key index fixed length encoding is obtained by use of little endian representation of an u64.