| 84 | } |
| 85 | |
| 86 | u8 *cryptomsg_decrypt_body(const tal_t *ctx, |
| 87 | struct crypto_state *cs, const u8 *in) |
| 88 | { |
| 89 | unsigned char npub[crypto_aead_chacha20poly1305_ietf_NPUBBYTES]; |
| 90 | unsigned long long mlen; |
| 91 | size_t inlen = tal_count(in); |
| 92 | u8 *decrypted; |
| 93 | |
| 94 | if (inlen < 16) |
| 95 | return NULL; |
| 96 | decrypted = tal_arr(ctx, u8, inlen - 16); |
| 97 | |
| 98 | le64_nonce(npub, cs->rn++); |
| 99 | |
| 100 | /* BOLT #8: |
| 101 | * |
| 102 | * 5. Decrypt `c` (using `ChaCha20-Poly1305`, `rn`, and `rk`), to |
| 103 | * obtain decrypted plaintext packet `p`. |
| 104 | * * The nonce `rn` MUST be incremented after this step. |
| 105 | */ |
| 106 | if (crypto_aead_chacha20poly1305_ietf_decrypt(decrypted, |
| 107 | &mlen, NULL, |
| 108 | memcheck(in, inlen), |
| 109 | inlen, |
| 110 | NULL, 0, |
| 111 | npub, cs->rk.data) != 0) { |
| 112 | /* FIXME: Report error! */ |
| 113 | return tal_free(decrypted); |
| 114 | } |
| 115 | assert(mlen == tal_count(decrypted)); |
| 116 | |
| 117 | maybe_rotate_key(&cs->rn, &cs->rk, &cs->r_ck); |
| 118 | return decrypted; |
| 119 | } |
| 120 | |
| 121 | bool cryptomsg_decrypt_header(struct crypto_state *cs, u8 hdr[18], u16 *lenp) |
| 122 | { |