Prevent derivation of unserializable extended keys

[quapka]

It's possible to derive unserializable, as defined by BIP32, extended keys.

Description

BIP32 serializes the depth of an extended key as a single byte. Thus, extended keys that are of depth greater than 255 are not possible to be serialized (in the BIP32 specified format). This commit introduces backwards-incompatible change that prevents a key of depth 256 and greater to be derived.

Notes for QA

Two tests (one for private -> private and another for public -> public derivation) were added, even though they are covered by the same fix. If there are other parts of the code base that do extended key derivation, these should be verified for similar overflow as well.

The changes are backwards-incompatible - however, as long as one has the original seed, any keys, even the unserializable, can be still derived.

Related Issue

• For more information, see BIP32: Maximal length of derivation paths and depth of extended keys bitcoin/bitcoin#32201
• Similar problem in trezor-firmware Prevent derivation of unserializable extended keys trezor-firmware#6219

[quapka]

I have noticed that your implementation originates from https://github.com/bitcoinjs/bip32/, thus it might be relevant to directly mention the upstream author's viewpoint (i.e., won't fix now), see bitcoinjs/bip32#92.