| 865 | } |
| 866 | |
| 867 | static struct io_plan *act_one_responder2(struct io_conn *conn, |
| 868 | struct handshake *h) |
| 869 | { |
| 870 | /* BOLT #8: |
| 871 | * |
| 872 | * 3. If `v` is an unrecognized handshake version, then the responder |
| 873 | * MUST abort the connection attempt. |
| 874 | */ |
| 875 | if (h->act1.v != 0) |
| 876 | return handshake_failed(conn, h); |
| 877 | |
| 878 | /* BOLT #8: |
| 879 | * |
| 880 | * * The raw bytes of the remote party's ephemeral public key |
| 881 | * (`re`) are to be deserialized into a point on the curve using |
| 882 | * affine coordinates as encoded by the key's serialized |
| 883 | * composed format. |
| 884 | */ |
| 885 | if (secp256k1_ec_pubkey_parse(secp256k1_ctx, &h->re.pubkey, |
| 886 | h->act1.pubkey, sizeof(h->act1.pubkey)) != 1) |
| 887 | return handshake_failed(conn, h); |
| 888 | |
| 889 | SUPERVERBOSE("# re=0x%s", type_to_string(tmpctx, struct pubkey, &h->re)); |
| 890 | |
| 891 | /* BOLT #8: |
| 892 | * |
| 893 | * 4. `h = SHA-256(h || re.serializeCompressed())` |
| 894 | * * The responder accumulates the initiator's ephemeral key into the |
| 895 | * authenticating handshake digest. |
| 896 | */ |
| 897 | sha_mix_in_key(&h->h, &h->re); |
| 898 | SUPERVERBOSE("# h=0x%s", tal_hexstr(tmpctx, &h->h, sizeof(h->h))); |
| 899 | |
| 900 | /* BOLT #8: |
| 901 | * |
| 902 | * 5. `es = ECDH(s.priv, re)` |
| 903 | * * The responder performs an ECDH between its static private key and |
| 904 | * the initiator's ephemeral public key. |
| 905 | */ |
| 906 | h->ss = tal(h, struct secret); |
| 907 | ecdh(&h->re, h->ss); |
| 908 | SUPERVERBOSE("# ss=0x%s", tal_hexstr(tmpctx, h->ss, sizeof(*h->ss))); |
| 909 | |
| 910 | /* BOLT #8: |
| 911 | * |
| 912 | * 6. `ck, temp_k1 = HKDF(ck, es)` |
| 913 | * * A new temporary encryption key is generated, which will |
| 914 | * shortly be used to check the authenticating MAC. |
| 915 | */ |
| 916 | hkdf_two_keys(&h->ck, &h->temp_k, &h->ck, h->ss, sizeof(*h->ss)); |
| 917 | SUPERVERBOSE("# ck,temp_k1=0x%s,0x%s", |
| 918 | tal_hexstr(tmpctx, &h->ck, sizeof(h->ck)), |
| 919 | tal_hexstr(tmpctx, &h->temp_k, sizeof(h->temp_k))); |
| 920 | |
| 921 | /* BOLT #8: |
| 922 | * |
| 923 | * 7. `p = decryptWithAD(temp_k1, 0, h, c)` |
| 924 | * * If the MAC check in this operation fails, then the initiator |
nothing calls this directly
no test coverage detected