Add provisos on experimental status, side-channel vulnerability (#6)

Makefile

@@ -1,4 +1,4 @@
-.PHONY: check install install-go lint test test-network
+.PHONY: check install install-go lint push test test-network
 
 check:
 	black . --check
@@ -18,6 +18,8 @@ lint:
 	black .
 	actionlint
 
+push: lint check test
+
 test:
 	python -m pytest tests -m "not network" -sx
 

README.md

@@ -1,18 +1,21 @@
-# `bipsea`: unlimited cryptographic entropy for Bitcoin, passwords, and other secrets
+# `bipsea`: unlimited entropy for Bitcoin, passwords, and other secrets
 
 > _One Seed to rule them all,  
 > One Key to find them,  
 > One Path to bring them all,  
 > And in cryptography bind them._  
 > —[BIP-85](https://github.com/bitcoin/bips/blob/master/bip-0085.mediawiki)
 
+bipsea is currently for experimental purposes only.
 bipsea is a standalone, test-driven implementation of BIP-85 and BIP-32.
-bipsea is designed for readability and security. bipsea offers a command-line
+bipsea is designed for readability and correctness. bipsea offers a command-line
 interface and an API.
 
 bipsea relies on cryptographic primitives from Python (`secrets`, `hashlib`),
-and the [python-ecdsa](https://github.com/tlsfuzzer/python-ecdsa). bipsea does not
-rely on third-party libraries from any wallet vendor.
+and the [python-ecdsa](https://github.com/tlsfuzzer/python-ecdsa) and is therefore
+also [vulnerable to side-channel attacks](https://github.com/tlsfuzzer/python-ecdsa?tab=readme-ov-file#security).
+bipsea does not rely on third-party libraries
+from any wallet vendor.
 
 You can run bipsea offline on to generate general-use passwords, Bitcoin seed words,
 and more. Consider dedicated cold hardware that runs [Tails](https://tails.net),
@@ -101,10 +104,6 @@ following provisos:
 * Only generates seed phrases in English
 * Fails one partial test for derived entropy (but passes all others) from BIP-85
 
-### TODO
-
-* [ ] File the above and other "TODO" issues to BIP-85
-
 Run `make test` for details.
 
 # Usage
@@ -187,6 +186,13 @@ Alternatively you can pipe in an existing xprv:
 echo "$XPRV" | bipsea entropy -a base85 -n 10
 ```
 
+Or call `--input`:
+```
+bipsea seed -f string -i "yoooooooooooooooo" -t xprv -n 12 | bipsea entropy -a base85 -n 10 -i 1
+```
+
+
+
 ### Derived seed words
 
 ```
@@ -241,3 +247,13 @@ hierarchical deterministic wallets
 generalized cryptographic entropy
 1. [BIP-44](https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki)
 generalized BIP-32 paths
+
+
+# TODO
+
+* [ ] File the above and other "TODO" issues to BIP-85
+* [ ] Investigate switch to secure ECDSA libs with constant-time programming and
+side-channel resistance.
+    * [ ] https://cryptography.io/en/latest/
+
+