static bool create_token(encrypted_token& out_token,
    const std::string& passphrase, data_slice owner_salt,
    const ek_entropy& owner_entropy,
    const byte_array<parse_encrypted_token::prefix_size>& prefix)
{
    BITCOIN_ASSERT(owner_salt.size() == ek_salt_size ||
        owner_salt.size() == ek_entropy_size);

    const auto lot_sequence = owner_salt.size() == ek_salt_size;
    auto factor = scrypt_token(normal(passphrase), owner_salt);

    if (lot_sequence)
        factor = bitcoin_hash(splice(factor, owner_entropy));

    ec_compressed point;
    if (!secret_to_public(point, factor))
        return false;

    return build_checked_array(out_token,
    {
        prefix,
        owner_entropy,
        point
    });
}

hash_digest hmac_sha256_hash(data_slice data, data_slice key)
{
    hash_digest hash;
    HMACSHA256(data.data(), data.size(), key.data(),
        key.size(), hash.data());
    return hash;
}

long_hash hmac_sha512_hash(data_slice data, data_slice key)
{
    long_hash hash;
    HMACSHA512(data.data(), data.size(), key.data(),
        key.size(), hash.data());
    return hash;
}

bool verify_checksum(data_slice data)
{
    if (data.size() < checksum_size)
        return false;

    data_slice body(data.begin(), data.end() - checksum_size);
    auto checksum = from_little_endian_unsafe<uint32_t>(data.end() - checksum_size);
    return bitcoin_checksum(body) == checksum;
}

data_chunk scrypt(data_slice data, data_slice salt, uint64_t N, uint32_t p,
    uint32_t r, size_t length)
{
    data_chunk output(length);
    const auto result = crypto_scrypt(data.data(), data.size(), salt.data(),
        salt.size(), N, r, p, output.data(), output.size());
    handle_script_result(result);
    return output;
}

bool is_uncompressed_key(data_slice point)
{
    const auto size = point.size();
    if (size != ec_uncompressed_size)
        return false;

    const auto first = point.data()[0];
    return first == uncompressed;
}

binary_type::binary_type(size_type size, data_slice blocks)
{
    // Copy blocks
    blocks_.resize(blocks.size());
    std::copy(blocks.begin(), blocks.end(), blocks_.begin());
    // Pad with 00 for safety.
    while (blocks_.size() * bits_per_block < size)
        blocks_.push_back(0x00);
    resize(size);
}

hash_digest sha256_hash(data_slice first, data_slice second)
{
    hash_digest hash;
    SHA256CTX context;
    SHA256Init(&context);
    SHA256Update(&context, first.data(), first.size());
    SHA256Update(&context, second.data(), second.size());
    SHA256Final(&context, hash.data());
    return hash;
}

long_hash pkcs5_pbkdf2_hmac_sha512(data_slice passphrase,
    data_slice salt, size_t iterations)
{
    long_hash hash;
    const auto result = pkcs5_pbkdf2(passphrase.data(), passphrase.size(),
        salt.data(), salt.size(), hash.data(), hash.size(), iterations);

    if (result != 0)
        throw std::bad_alloc();

    return hash;
}

// Accepts only byte arrays bounded to 4 bytes.
bool encode_base85(std::string& out, data_slice in)
{
    const size_t size = in.size();
    if (size % 4 != 0)
        return false;

    const size_t encoded_size = size * 5 / 4;
    std::string encoded;
    encoded.reserve(encoded_size + 1);
    size_t byte_index = 0;
    uint32_t accumulator = 0;

    for (const uint8_t unencoded_byte: in)
    {
        accumulator = accumulator * 256 + unencoded_byte;
        if (++byte_index % 4 == 0)
        {
            for (uint32_t divise = 85 * 85 * 85 * 85; divise > 0; divise /= 85)
                encoded.push_back(encoder[accumulator / divise % 85]);

            accumulator = 0;
        }
    }

    out.assign(encoded.begin(), encoded.end());
    BITCOIN_ASSERT(out.size() == encoded_size);
    return true;
}

operation::stack operation::to_null_data_pattern(data_slice data)
{
    if (data.size() > max_null_data_size)
        return operation::stack();

    return operation::stack
    {
        operation{ opcode::return_, data_chunk() },
        operation{ opcode::special, to_chunk(data) }
    };
}

bool verify_signature(data_slice point, const hash_digest& hash,
    const ec_signature& signature)
{
    // Copy to avoid exposing external types.
    secp256k1_ecdsa_signature parsed;
    std::copy(signature.begin(), signature.end(), std::begin(parsed.data));

    // secp256k1_ecdsa_verify rejects non-normalized (low-s) signatures, but
    // bitcoin does not have such a limitation, so we always normalize.
    secp256k1_ecdsa_signature normal;
    const auto context = verification.context();
    secp256k1_ecdsa_signature_normalize(context, &normal, &parsed);

    // This uses a data slice and calls secp256k1_ec_pubkey_parse() in place of
    // parse() so that we can support the der_verify data_chunk optimization.
    secp256k1_pubkey pubkey;
    const auto size = point.size();
    return
        secp256k1_ec_pubkey_parse(context, &pubkey, point.data(), size) == 1 &&
        secp256k1_ecdsa_verify(context, &normal, hash.data(), &pubkey) == 1;
}

// This verifies the checksum.
bool unwrap(wallet::wrapped_data& data, data_slice wrapped)
{
    if (!verify_checksum(wrapped))
        return false;

    data.version = wrapped.data()[0];
    const auto payload_begin = std::begin(wrapped) + 1;
    const auto checksum_begin = std::end(wrapped) - checksum_size;
    data.payload.resize(checksum_begin - payload_begin);
    std::copy(payload_begin, checksum_begin, data.payload.begin());
    data.checksum = from_little_endian_unsafe<uint32_t>(checksum_begin);
    return true;
}

word_list create_mnemonic(data_slice entropy, const dictionary &lexicon)
{
    if ((entropy.size() % mnemonic_seed_multiple) != 0)
        return word_list();

    const size_t entropy_bits = (entropy.size() * byte_bits);
    const size_t check_bits = (entropy_bits / entropy_bit_divisor);
    const size_t total_bits = (entropy_bits + check_bits);
    const size_t word_count = (total_bits / bits_per_word);

    BITCOIN_ASSERT((total_bits % bits_per_word) == 0);
    BITCOIN_ASSERT((word_count % mnemonic_word_multiple) == 0);

    const auto data = build_chunk({entropy, sha256_hash(entropy)});

    size_t bit = 0;
    word_list words;

    for (size_t word = 0; word < word_count; word++)
    {
        size_t position = 0;
        for (size_t loop = 0; loop < bits_per_word; loop++)
        {
            bit = (word * bits_per_word + loop);
            position <<= 1;

            const auto byte = bit / byte_bits;

            if ((data[byte] & bip39_shift(bit)) > 0)
                position++;
        }

        BITCOIN_ASSERT(position < dictionary_size);
        words.push_back(lexicon[position]);
    }

    BITCOIN_ASSERT(words.size() == ((bit + 1) / bits_per_word));
    return words;
}

inline data_chunk operator +(data_slice a, data_slice b)
{
    data_chunk out;
    out.reserve(a.size() + b.size());
    out.insert(out.end(), a.begin(), a.end());
    out.insert(out.end(), b.begin(), b.end());
    return out;
}

std::string encode_base58(data_slice unencoded)
{
    size_t leading_zeros = count_leading_zeros(unencoded);

    // size = log(256) / log(58), rounded up.
    const size_t number_nonzero = unencoded.size() - leading_zeros;
    const size_t indexes_size = number_nonzero * 138 / 100 + 1;

    // Allocate enough space in big-endian base58 representation.
    data_chunk indexes(indexes_size);

    // Process the bytes.
    for (auto it = unencoded.begin() + leading_zeros;
        it != unencoded.end(); ++it)
    {
        pack_value(indexes, *it);
    }

    // Skip leading zeroes in base58 result.
    auto first_nonzero = search_first_nonzero(indexes);

    // Translate the result into a string.
    std::string encoded;
    const size_t estimated_size = leading_zeros + 
        (indexes.end() - first_nonzero);
    encoded.reserve(estimated_size);
    encoded.assign(leading_zeros, '1');

    // Set actual main bytes.
    for (auto it = first_nonzero; it != indexes.end(); ++it)
    {
        const size_t index = *it;
        encoded += base58_chars[index];
    }

    return encoded;
}

bool unwrap(uint8_t& version, data_chunk& payload, uint32_t& checksum,
    data_slice wrapped)
{
    constexpr size_t version_length = sizeof(version);
    constexpr size_t checksum_length = sizeof(checksum);
    // guard against insufficient buffer length
    if (wrapped.size() < version_length + checksum_length)
        return false;
    if (!verify_checksum(wrapped))
        return false;
    // set return values
    version = wrapped.data()[0];
    payload = data_chunk(wrapped.begin() + version_length,
        wrapped.end() - checksum_length);
    const auto checksum_start = wrapped.end() - checksum_length;
    auto deserial = make_deserializer(checksum_start, wrapped.end());
    checksum = deserial.read_4_bytes();
    return true;
}

/**
 * Shoves data into a std::string object.
 */
std::string to_string(data_slice data)
{
    return std::string(data.begin(), data.end());
}

long_hash sha512_hash(data_slice data)
{
    long_hash hash;
    SHA512_(data.data(), data.size(), hash.data());
    return hash;
}

hash_digest sha256_hash(data_slice data)
{
    hash_digest hash;
    SHA256_(data.data(), data.size(), hash.data());
    return hash;
}