Skip to content

Commit 74ef03d

Browse files
committed
lightningd: use tweak on node_id of different key, for createinvoicerequest.
It's an internal difference, so doesn't actually break compatibility (it would if we tried to prove we owned an old invoicerequest, but we don't have infrastructure for that anyway). Signed-off-by: Rusty Russell <[email protected]>
1 parent fa33a2f commit 74ef03d

File tree

7 files changed

+38
-48
lines changed

7 files changed

+38
-48
lines changed

common/bolt12_merkle.c

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -218,23 +218,3 @@ void sighash_from_merkle(const char *messagename,
218218
sha256_update(&sctx, merkle, sizeof(*merkle));
219219
sha256_done(&sctx, sighash);
220220
}
221-
222-
/* We use the SHA(pubkey | publictweak); so reader cannot figure out the
223-
* tweak and derive the base key.
224-
*/
225-
void payer_key_tweak(const struct pubkey *bolt12,
226-
const u8 *publictweak, size_t publictweaklen,
227-
struct sha256 *tweak)
228-
{
229-
u8 rawkey[PUBKEY_CMPR_LEN];
230-
struct sha256_ctx sha;
231-
232-
pubkey_to_der(rawkey, bolt12);
233-
234-
sha256_init(&sha);
235-
sha256_update(&sha, rawkey, sizeof(rawkey));
236-
sha256_update(&sha,
237-
memcheck(publictweak, publictweaklen),
238-
publictweaklen);
239-
sha256_done(&sha, tweak);
240-
}

common/bolt12_merkle.h

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,4 @@ void sighash_from_merkle(const char *messagename,
2121
const char *fieldname,
2222
const struct sha256 *merkle,
2323
struct sha256 *sighash);
24-
25-
/**
26-
* payer_key_tweak - get the actual tweak to use for a payer_key
27-
*/
28-
void payer_key_tweak(const struct pubkey *bolt12,
29-
const u8 *publictweak, size_t publictweaklen,
30-
struct sha256 *tweak);
31-
3224
#endif /* LIGHTNING_COMMON_BOLT12_MERKLE_H */

hsmd/libhsmd.c

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -730,6 +730,21 @@ static u8 *handle_sign_option_will_fund_offer(struct hsmd_client *c,
730730
return towire_hsmd_sign_option_will_fund_offer_reply(NULL, &sig);
731731
}
732732

733+
static void payer_key_tweak(const struct pubkey *bolt12,
734+
const u8 *publictweak, size_t publictweaklen,
735+
struct sha256 *tweak)
736+
{
737+
u8 rawkey[PUBKEY_CMPR_LEN];
738+
struct sha256_ctx sha;
739+
740+
pubkey_to_der(rawkey, bolt12);
741+
742+
sha256_init(&sha);
743+
sha256_update(&sha, rawkey, sizeof(rawkey));
744+
sha256_update(&sha, publictweak, publictweaklen);
745+
sha256_done(&sha, tweak);
746+
}
747+
733748
/*~ lightningd asks us to sign a bolt12 (e.g. offer). */
734749
static u8 *handle_sign_bolt12(struct hsmd_client *c, const u8 *msg_in)
735750
{

lightningd/hsm_control.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ struct ext_key *hsm_init(struct lightningd *ld)
8787
int fds[2];
8888
struct ext_key *bip32_base;
8989
u32 hsm_version;
90+
struct pubkey unused;
9091

9192
/* We actually send requests synchronously: only status is async. */
9293
if (socketpair(AF_LOCAL, SOCK_STREAM, 0, fds) != 0)
@@ -142,7 +143,7 @@ struct ext_key *hsm_init(struct lightningd *ld)
142143
&hsm_version,
143144
&ld->hsm_capabilities,
144145
&ld->our_nodeid, bip32_base,
145-
&ld->bolt12_base)) {
146+
&unused)) {
146147
/* nothing to do. */
147148
} else {
148149
if (ld->config.keypass)

lightningd/lightningd.h

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -151,10 +151,7 @@ struct lightningd {
151151
struct node_id our_nodeid;
152152
struct pubkey our_pubkey;
153153

154-
/* The public base for our payer_id keys */
155-
struct pubkey bolt12_base;
156-
157-
/* Secret base for our invoices */
154+
/* Secret base for our invoices. */
158155
struct secret invoicesecret_base;
159156

160157
/* Secret base for node aliases */

lightningd/offer.c

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -56,17 +56,21 @@ static void hsm_sign_b12(struct lightningd *ld,
5656
{
5757
const u8 *msg;
5858
struct sha256 sighash;
59+
/* Needs to be a (non-nul-terminated) tal_arr */
60+
const u8 *info = tal_dup_arr(tmpctx, u8,
61+
(const u8 *)NODE_ALIAS_BASE_STRING,
62+
strlen(NODE_ALIAS_BASE_STRING), 0);
5963

60-
msg = towire_hsmd_sign_bolt12(NULL, messagename, fieldname, merkle,
61-
publictweak);
64+
msg = towire_hsmd_sign_bolt12_2(NULL, messagename, fieldname, merkle,
65+
info, publictweak);
6266
msg = hsm_sync_req(tmpctx, ld, take(msg));
63-
if (!fromwire_hsmd_sign_bolt12_reply(msg, sig))
64-
fatal("HSM gave bad sign_offer_reply %s",
67+
if (!fromwire_hsmd_sign_bolt12_2_reply(msg, sig))
68+
fatal("HSM gave bad sign_bolt12_2 %s",
6569
tal_hex(msg, msg));
6670

6771
/* Now we sanity-check! */
6872
sighash_from_merkle(messagename, fieldname, merkle, &sighash);
69-
if (!check_schnorr_sig(&sighash, &key->pubkey, sig))
73+
if (!check_schnorr_sig(&sighash, &key->pubkey, sig))
7074
fatal("HSM gave bad signature %s for pubkey %s",
7175
fmt_bip340sig(tmpctx, sig),
7276
fmt_pubkey(tmpctx, key));
@@ -361,10 +365,11 @@ static bool payer_key(struct lightningd *ld,
361365
{
362366
struct sha256 tweakhash;
363367

364-
payer_key_tweak(&ld->bolt12_base, public_tweak, public_tweak_len,
365-
&tweakhash);
368+
*key = ld->our_pubkey;
369+
bolt12_alias_tweak(&ld->nodealias_base,
370+
public_tweak, public_tweak_len,
371+
&tweakhash);
366372

367-
*key = ld->bolt12_base;
368373
return secp256k1_ec_pubkey_tweak_add(secp256k1_ctx,
369374
&key->pubkey,
370375
tweakhash.u.u8) == 1;

tests/test_pay.py

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5246,13 +5246,13 @@ def test_payerkey(node_factory):
52465246
"""payerkey calculation should not change across releases!"""
52475247
nodes = node_factory.get_nodes(7)
52485248

5249-
expected_keys = ["02294ec1cd3f100947fe859d71a42cb87932e36e7771abf2d50b02a7a92be8e4d5",
5250-
"026a4a3b6b0c694da6f14629ca5140713fc703591a6d8aae5c79ba9b5556fc5723",
5251-
"03defd2b1f3004b0145351f469f34512c6fa4d02fe891a977bafdb34fe7b73ea48",
5252-
"03eccb00c0a3c760465bb69a6297d7cfa5bcbd989d5a88e435bd8d6e4c723013cd",
5253-
"021b4bfa652f0df7498d734b0ca888b4e3b07f59e1a974ec7d4a9d6046e8e5ab92",
5254-
"03fc91d60b061e517f9182e3e40ea14c27df520c51db204f1409ff50e5cf9a5e4d",
5255-
"03a3bbda0137722ba62207b9d3e5e6cc2a11e58480f801892093e01383aacb7fb2"]
5249+
expected_keys = ["035e43e4ec029ee6cc0e320ebefdf863bc0f284ec0208275f780837d17e21bba32",
5250+
"02411811b24f4940de49ad460ee14ecb96810e29ca49cdd3600a985da2eda06b87",
5251+
"036a19f00424ff244af1841715e89f3716c08f1f62a8e5d9bd0f69a21aa96a7b8d",
5252+
"026d8b82fe6039fe16f8ef376174b630247e821331b90620315a1e9c3db8384056",
5253+
"0393fb950e04916c063a585aa644df3d72642c16de4eb44ccf5dbede194836140f",
5254+
"030b68257230f7057e694222bbd54d9d108decced6b647a90da6f578360af53f7d",
5255+
"02f402bd7374a1304b07c7236d9c683b83f81072517195ddede8ab328026d53157"]
52565256

52575257
for n, k in zip(nodes, expected_keys):
52585258
b12 = n.rpc.createinvoicerequest('lnr1qqgz2d7u2smys9dc5q2447e8thjlgq3qqc3xu3s3rg94nj40zfsy866mhu5vxne6tcej5878k2mneuvgjy8ssqvepgz5zsjrg3z3vggzvkm2khkgvrxj27r96c00pwl4kveecdktm29jdd6w0uwu5jgtv5v9qgqxyfhyvyg6pdvu4tcjvpp7kkal9rp57wj7xv4pl3ajku70rzy3pu', False)['bolt12']

0 commit comments

Comments
 (0)