f Use unique keys for deriving inbound payment secrets

Author: valentinewallace

lightning/src/ln/channelmanager.rs

@@ -643,6 +643,8 @@ pub struct ChannelManager<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref,
 	our_network_key: SecretKey,
 	our_network_pubkey: PublicKey,
 
+	inbound_payment_key: SecretKey,
+
 	/// Used to track the last value sent in a node_announcement "timestamp" field. We ensure this
 	/// value increases strictly since we don't assume access to a time source.
 	last_node_announcement_serial: AtomicUsize,
@@ -1343,6 +1345,8 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 			our_network_pubkey: PublicKey::from_secret_key(&secp_ctx, &keys_manager.get_node_secret()),
 			secp_ctx,
 
+			inbound_payment_key: keys_manager.get_inbound_payment_secret(),
+
 			last_node_announcement_serial: AtomicUsize::new(0),
 			highest_seen_timestamp: AtomicUsize::new(0),
 
@@ -2594,7 +2598,7 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 	// `create_inbound_payment_for_hash` for details on our checks.
 	fn verify_inbound_payment_data(&self, payment_hash: PaymentHash, payment_data: msgs::FinalOnionHopData) -> Result<Option<PaymentPreimage>, ()> {
 		let (iv_bytes, encrypted_metadata_bytes) = payment_data.payment_secret.0.split_at(16);
-		let mut chacha = ChaCha20::new(&self.our_network_key[..], &iv_bytes[..12]);
+		let mut chacha = ChaCha20::new(&self.inbound_payment_key[..], &iv_bytes[..12]);
 		let mut chacha_bytes = [0; 16];
 		chacha.process_in_place(&mut chacha_bytes);
 
@@ -2610,9 +2614,10 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 		}
 
 		let is_user_payment_hash = metadata_bytes[0] & 1 << 7 != 0;
+		let (user_pmt_hash_key, ldk_pmt_hash_key) = hkdf_extract_expand(&vec![0], &self.inbound_payment_key[..]);
 		let mut payment_preimage = None;
 		if is_user_payment_hash {
-			let mut hmac = HmacEngine::<Sha256>::new(&self.our_network_key[..]);
+			let mut hmac = HmacEngine::<Sha256>::new(&user_pmt_hash_key);
 			hmac.input(&metadata_bytes[..]);
 			hmac.input(&payment_hash.0[..]);
 			if iv_bytes != Hmac::from_engine(hmac).into_inner().split_at_mut(16).0 {
@@ -2634,7 +2639,7 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 				log_trace!(self.logger, "Failing HTLC with payment_hash {} due to total_msat {} being less than the minimum amount of {} msat", log_bytes!(payment_hash.0), payment_data.total_msat, min_amt_msat);
 				return Err(())
 			}
-			let mut hmac = HmacEngine::<Sha256>::new(&self.our_network_key[..]);
+			let mut hmac = HmacEngine::<Sha256>::new(&ldk_pmt_hash_key);
 			hmac.input(&iv_bytes);
 			hmac.input(&metadata_bytes);
 			let decoded_payment_preimage = Hmac::from_engine(hmac).into_inner();
@@ -4616,7 +4621,7 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 	// 	METADATA = payment amount (8 bytes) || expiry (8 bytes)
 	// 	IV = 16 random bytes
 	// 	payment_preimage = HMAC(ldk_pmt_hash_key, IV || METADATA)
-	// 	payment_secret = IV || CHACHA(self.inbound_payments_key, IV) xor METADATA
+	// 	payment_secret = IV || CHACHA(self.inbound_payment_key, IV) xor METADATA
 	//
 	// Then on payment receipt, we verify in `verify_inbound_payment_data` that the payment preimage
 	// and payment secret match what was constructed in `create_inbound_payment`.
@@ -4641,7 +4646,8 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 		let rand_bytes = self.keys_manager.get_secure_random_bytes();
 		let iv_bytes = &rand_bytes[..16];
 
-		let mut hmac = HmacEngine::<Sha256>::new(&self.our_network_key[..]);
+		let (_, ldk_pmt_hash_key) = hkdf_extract_expand(&vec![0], &self.inbound_payment_key[..]);
+		let mut hmac = HmacEngine::<Sha256>::new(&ldk_pmt_hash_key);
 		hmac.input(iv_bytes);
 		hmac.input(&metadata_bytes);
 		let payment_preimage_bytes = Hmac::from_engine(hmac).into_inner();
@@ -4651,7 +4657,7 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 			let (iv_slice, encrypted_metadata_slice) = payment_secret_bytes.split_at_mut(16);
 			iv_slice.copy_from_slice(iv_bytes);
 
-			let mut chacha = ChaCha20::new(&self.our_network_key[..], &iv_bytes[..12]);
+			let mut chacha = ChaCha20::new(&self.inbound_payment_key[..], &iv_bytes[..12]);
 			let mut chacha_bytes = [0; 16];
 			chacha.process_in_place(&mut chacha_bytes);
 
@@ -4702,7 +4708,7 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 	//
 	// 	METADATA = top bit set for user-generated payment hash || payment amount (8 bytes) || expiry (8 bytes)
 	// 	IV = HMAC(user_pmt_hash_key, METADATA || payment_hash)[0..16]
-	// 	payment_secret = IV || CHACHA(self.inbound_payments_key, IV) xor METADATA
+	// 	payment_secret = IV || CHACHA(self.inbound_payment_key, IV) xor METADATA
 	//
 	// Then on payment receipt, we verify in `verify_inbound_payment_data` that the payment preimage
 	// and payment secret match what was constructed in `create_inbound_payment`.
@@ -4729,7 +4735,8 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 			expiry_slice.copy_from_slice(&expiry_bytes);
 		}
 
-		let mut hmac = HmacEngine::<Sha256>::new(&self.our_network_key[..]);
+		let (user_pmt_hash_key, _) = hkdf_extract_expand(&vec![0], &self.inbound_payment_key[..]);
+		let mut hmac = HmacEngine::<Sha256>::new(&user_pmt_hash_key);
 		hmac.input(&metadata_bytes);
 		hmac.input(&payment_hash.0);
 		let hmac_bytes = Hmac::from_engine(hmac).into_inner();
@@ -4740,7 +4747,7 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> ChannelMana
 			let (iv_slice, encrypted_metadata_slice) = payment_secret_bytes.split_at_mut(16);
 			iv_slice.copy_from_slice(iv_bytes);
 
-			let mut chacha = ChaCha20::new(&self.our_network_key[..], &iv_bytes[..12]);
+			let mut chacha = ChaCha20::new(&self.inbound_payment_key[..], &iv_bytes[..12]);
 			let mut chacha_bytes = [0; 16];
 			chacha.process_in_place(&mut chacha_bytes);
 
@@ -5820,6 +5827,7 @@ impl<Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref> Writeable f
 		}
 		write_tlv_fields!(writer, {
 			(1, pending_outbound_payments_no_retry, required),
+			(2, self.inbound_payment_key, required),
 			(3, pending_outbound_payments, required),
 		});
 
@@ -6115,10 +6123,15 @@ impl<'a, Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref>
 		// pending_outbound_payments_no_retry is for compatibility with 0.0.101 clients.
 		let mut pending_outbound_payments_no_retry: Option<HashMap<PaymentId, HashSet<[u8; 32]>>> = None;
 		let mut pending_outbound_payments = None;
+		let mut inbound_payment_key = None;
 		read_tlv_fields!(reader, {
 			(1, pending_outbound_payments_no_retry, option),
+			(2, inbound_payment_key, option),
 			(3, pending_outbound_payments, option),
 		});
+		if inbound_payment_key.is_none() {
+			inbound_payment_key = Some(args.keys_manager.get_inbound_payment_secret());
+		}
 		if pending_outbound_payments.is_none() && pending_outbound_payments_no_retry.is_none() {
 			pending_outbound_payments = Some(pending_outbound_payments_compat);
 		} else if pending_outbound_payments.is_none() {
@@ -6196,6 +6209,7 @@ impl<'a, Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref>
 				claimable_htlcs,
 				pending_msg_events: Vec::new(),
 			}),
+			inbound_payment_key: inbound_payment_key.unwrap(),
 			pending_inbound_payments: Mutex::new(pending_inbound_payments),
 			pending_outbound_payments: Mutex::new(pending_outbound_payments.unwrap()),
 
@@ -6229,6 +6243,19 @@ impl<'a, Signer: Sign, M: Deref, T: Deref, K: Deref, F: Deref, L: Deref>
 	}
 }
 
+fn hkdf_extract_expand(salt: &[u8], ikm: &[u8]) -> ([u8; 32], [u8; 32]) {
+	let mut hmac = HmacEngine::<Sha256>::new(salt);
+	hmac.input(ikm);
+	let prk = Hmac::from_engine(hmac).into_inner();
+	let mut hmac = HmacEngine::<Sha256>::new(&prk[..]);
+	hmac.input(&[1; 1]);
+	let t1 = Hmac::from_engine(hmac).into_inner();
+	let mut hmac = HmacEngine::<Sha256>::new(&prk[..]);
+	hmac.input(&t1);
+	hmac.input(&[2; 1]);
+	(t1, Hmac::from_engine(hmac).into_inner())
+}
+
 #[cfg(test)]
 mod tests {
 	use bitcoin::hashes::Hash;