~ lightningd asks us to sign a message. I tweeted the spec * in https://twitter.com/rusty_twit/status/1182102005914800128: * * @roasbeef & @bitconner point out that #lnd algo is: * zbase32(SigRec(SHA256(SHA256("Lightning Signed Message:" + msg)))). * zbase32 from https://philzimmermann.com/docs/human-oriented-base-32-encoding.txt * and SigRec has first byte 31 + recovery id, followed by
| 550 | * and SigRec has first byte 31 + recovery id, followed by 64 byte sig. #specinatweet |
| 551 | */ |
| 552 | static u8 *handle_sign_message(struct hsmd_client *c, const u8 *msg_in) |
| 553 | { |
| 554 | u8 *msg; |
| 555 | struct sha256_ctx sctx = SHA256_INIT; |
| 556 | struct sha256_double shad; |
| 557 | secp256k1_ecdsa_recoverable_signature rsig; |
| 558 | struct privkey node_pkey; |
| 559 | |
| 560 | if (!fromwire_hsmd_sign_message(tmpctx, msg_in, &msg)) |
| 561 | return hsmd_status_malformed_request(c, msg_in); |
| 562 | |
| 563 | /* Prefixing by a known string means we'll never be convinced |
| 564 | * to sign some gossip message, etc. */ |
| 565 | sha256_update(&sctx, "Lightning Signed Message:", |
| 566 | strlen("Lightning Signed Message:")); |
| 567 | sha256_update(&sctx, msg, tal_count(msg)); |
| 568 | sha256_double_done(&sctx, &shad); |
| 569 | |
| 570 | node_key(&node_pkey, NULL); |
| 571 | /*~ By no small coincidence, this libsecp routine uses the exact |
| 572 | * recovery signature format mandated by BOLT 11. */ |
| 573 | if (!secp256k1_ecdsa_sign_recoverable(secp256k1_ctx, &rsig, |
| 574 | shad.sha.u.u8, |
| 575 | node_pkey.secret.data, |
| 576 | NULL, NULL)) { |
| 577 | return hsmd_status_bad_request(c, msg_in, "Failed to sign message"); |
| 578 | } |
| 579 | |
| 580 | return towire_hsmd_sign_message_reply(NULL, &rsig); |
| 581 | } |
| 582 | |
| 583 | /*~ lightningd asks us to sign a liquidity ad offer */ |
| 584 | static u8 *handle_sign_option_will_fund_offer(struct hsmd_client *c, |
no test coverage detected