| 60 | } |
| 61 | |
| 62 | static u8 *enctlv_from_encmsg_raw(const tal_t *ctx, |
| 63 | const struct privkey *blinding, |
| 64 | const struct pubkey *node, |
| 65 | const u8 *raw_encmsg TAKES, |
| 66 | struct privkey *next_blinding, |
| 67 | struct pubkey *node_alias) |
| 68 | { |
| 69 | /* https://github.com/lightning/bolts/blob/route-blinding/proposals/route-blinding.md */ |
| 70 | struct secret ss, rho; |
| 71 | u8 *ret; |
| 72 | int ok; |
| 73 | /* All-zero npub */ |
| 74 | static const unsigned char npub[crypto_aead_chacha20poly1305_ietf_NPUBBYTES]; |
| 75 | |
| 76 | /* |
| 77 | * shared secret known only by N(r) and N(i): |
| 78 | * ss(i) = H(e(i) * P(i)) = H(k(i) * E(i)) |
| 79 | */ |
| 80 | if (secp256k1_ecdh(secp256k1_ctx, ss.data, |
| 81 | &node->pubkey, blinding->secret.data, |
| 82 | NULL, NULL) != 1) |
| 83 | return NULL; |
| 84 | SUPERVERBOSE("\t\"ss\": \"%s\",\n", |
| 85 | type_to_string(tmpctx, struct secret, &ss)); |
| 86 | |
| 87 | /* This calculates the node's alias, and next blinding */ |
| 88 | if (!blind_node(blinding, &ss, node, node_alias, next_blinding)) |
| 89 | return NULL; |
| 90 | |
| 91 | ret = tal_dup_talarr(ctx, u8, raw_encmsg); |
| 92 | SUPERVERBOSE("\t\"encmsg_hex\": \"%s\",\n", tal_hex(tmpctx, ret)); |
| 93 | |
| 94 | /* |
| 95 | * Key used to encrypt payload for N(i) by N(r): |
| 96 | * rho(i) = HMAC256("rho", ss(i)) |
| 97 | */ |
| 98 | subkey_from_hmac("rho", &ss, &rho); |
| 99 | SUPERVERBOSE("\t\"rho\": \"%s\",\n", |
| 100 | type_to_string(tmpctx, struct secret, &rho)); |
| 101 | |
| 102 | /* Encrypt in place */ |
| 103 | towire_pad(&ret, crypto_aead_chacha20poly1305_ietf_ABYTES); |
| 104 | |
| 105 | ok = crypto_aead_chacha20poly1305_ietf_encrypt(ret, NULL, |
| 106 | ret, |
| 107 | tal_bytelen(ret) |
| 108 | - crypto_aead_chacha20poly1305_ietf_ABYTES, |
| 109 | NULL, 0, |
| 110 | NULL, npub, |
| 111 | rho.data); |
| 112 | assert(ok == 0); |
| 113 | |
| 114 | return ret; |
| 115 | } |
| 116 | |
| 117 | static u8 *enctlv_from_encmsg(const tal_t *ctx, |
| 118 | const struct privkey *blinding, |