| 29 | } |
| 30 | |
| 31 | static void maybe_rotate_key(u64 *n, struct secret *k, struct secret *ck) |
| 32 | { |
| 33 | struct secret new_k, new_ck; |
| 34 | |
| 35 | /* BOLT #8: |
| 36 | * |
| 37 | * A key is to be rotated after a party encrypts or decrypts 1000 times |
| 38 | * with it (i.e. every 500 messages). This can be properly accounted |
| 39 | * for by rotating the key once the nonce dedicated to it |
| 40 | * exceeds 1000. |
| 41 | */ |
| 42 | if (*n != 1000) |
| 43 | return; |
| 44 | |
| 45 | /* BOLT #8: |
| 46 | * |
| 47 | * Key rotation for a key `k` is performed according to the following |
| 48 | * steps: |
| 49 | * |
| 50 | * 1. Let `ck` be the chaining key obtained at the end of Act Three. |
| 51 | * 2. `ck', k' = HKDF(ck, k)` |
| 52 | * 3. Reset the nonce for the key to `n = 0`. |
| 53 | * 4. `k = k'` |
| 54 | * 5. `ck = ck'` |
| 55 | */ |
| 56 | hkdf_two_keys(&new_ck, &new_k, ck, k); |
| 57 | #ifdef SUPERVERBOSE |
| 58 | status_debug("# 0x%s, 0x%s = HKDF(0x%s, 0x%s)", |
| 59 | tal_hexstr(trc, &new_ck, sizeof(new_ck)), |
| 60 | tal_hexstr(trc, &new_k, sizeof(new_k)), |
| 61 | tal_hexstr(trc, ck, sizeof(*ck)), |
| 62 | tal_hexstr(trc, k, sizeof(*k))); |
| 63 | #endif |
| 64 | *ck = new_ck; |
| 65 | *k = new_k; |
| 66 | *n = 0; |
| 67 | } |
| 68 | |
| 69 | static void le64_nonce(unsigned char *npub, u64 nonce) |
| 70 | { |
no test coverage detected