| 127 | } |
| 128 | |
| 129 | bool unblind_onion(const struct pubkey *path_key, |
| 130 | void (*ecdh)(const struct pubkey *point, struct secret *ss), |
| 131 | struct pubkey *onion_key, |
| 132 | struct secret *ss) |
| 133 | { |
| 134 | struct secret hmac; |
| 135 | |
| 136 | /* BOLT #4: |
| 137 | * A reader: |
| 138 | *... |
| 139 | * - if `path_key` is specified: |
| 140 | * - Calculate the `blinding_ss` as ECDH(`path_key`, `node_privkey`). |
| 141 | * - Either: |
| 142 | * - Tweak `public_key` by multiplying by $`HMAC256(\text{"blinded\_node\_id"}, blinding\_ss)`$. |
| 143 | * - or (equivalently): |
| 144 | * - Tweak its own `node_privkey` below by multiplying by $`HMAC256(\text{"blinded\_node\_id"}, blinding\_ss)`$. |
| 145 | * - Derive the shared secret `ss` as ECDH(`public_key`, `node_privkey`) |
| 146 | * (see [Shared Secret](#shared-secret)). |
| 147 | */ |
| 148 | ecdh(path_key, ss); |
| 149 | subkey_from_hmac("blinded_node_id", ss, &hmac); |
| 150 | |
| 151 | /* We tweak the *ephemeral* key from the onion and use |
| 152 | * our normal privkey: since hsmd knows only how to ECDH with |
| 153 | * our real key. */ |
| 154 | return secp256k1_ec_pubkey_tweak_mul(secp256k1_ctx, |
| 155 | &onion_key->pubkey, |
| 156 | hmac.data) == 1; |
| 157 | } |
| 158 | |
| 159 | u8 *decrypt_encmsg_raw(const tal_t *ctx, |
| 160 | const struct secret *ss, |