| 885 | } |
| 886 | |
| 887 | static struct io_plan *act_one_responder2(struct io_conn *conn, |
| 888 | struct handshake *h) |
| 889 | { |
| 890 | /* BOLT #8: |
| 891 | * |
| 892 | * 3. If `v` is an unrecognized handshake version, then the responder |
| 893 | * MUST abort the connection attempt. |
| 894 | */ |
| 895 | if (h->act1.v != 0) |
| 896 | return handshake_failed(conn, h); |
| 897 | |
| 898 | /* BOLT #8: |
| 899 | * |
| 900 | * * The raw bytes of the remote party's ephemeral public key |
| 901 | * (`re`) are to be deserialized into a point on the curve using |
| 902 | * affine coordinates as encoded by the key's serialized |
| 903 | * composed format. |
| 904 | */ |
| 905 | if (secp256k1_ec_pubkey_parse(secp256k1_ctx, &h->re.pubkey, |
| 906 | h->act1.pubkey, sizeof(h->act1.pubkey)) != 1) |
| 907 | return handshake_failed(conn, h); |
| 908 | |
| 909 | SUPERVERBOSE("# re=0x%s", fmt_pubkey(tmpctx, &h->re)); |
| 910 | |
| 911 | /* BOLT #8: |
| 912 | * |
| 913 | * 4. `h = SHA-256(h || re.serializeCompressed())` |
| 914 | * * The responder accumulates the initiator's ephemeral key into the |
| 915 | * authenticating handshake digest. |
| 916 | */ |
| 917 | sha_mix_in_key(&h->h, &h->re); |
| 918 | SUPERVERBOSE("# h=0x%s", tal_hexstr(tmpctx, &h->h, sizeof(h->h))); |
| 919 | |
| 920 | /* BOLT #8: |
| 921 | * |
| 922 | * 5. `es = ECDH(s.priv, re)` |
| 923 | * * The responder performs an ECDH between its static private key and |
| 924 | * the initiator's ephemeral public key. |
| 925 | */ |
| 926 | h->ss = tal(h, struct secret); |
| 927 | ecdh(&h->re, h->ss); |
| 928 | SUPERVERBOSE("# ss=0x%s", tal_hexstr(tmpctx, h->ss, sizeof(*h->ss))); |
| 929 | |
| 930 | /* BOLT #8: |
| 931 | * |
| 932 | * 6. `ck, temp_k1 = HKDF(ck, es)` |
| 933 | * * A new temporary encryption key is generated, which will |
| 934 | * shortly be used to check the authenticating MAC. |
| 935 | */ |
| 936 | hkdf_two_keys(&h->ck, &h->temp_k, &h->ck, h->ss, sizeof(*h->ss)); |
| 937 | SUPERVERBOSE("# ck,temp_k1=0x%s,0x%s", |
| 938 | tal_hexstr(tmpctx, &h->ck, sizeof(h->ck)), |
| 939 | tal_hexstr(tmpctx, &h->temp_k, sizeof(h->temp_k))); |
| 940 | |
| 941 | /* BOLT #8: |
| 942 | * |
| 943 | * 7. `p = decryptWithAD(temp_k1, 0, h, c)` |
| 944 | * * If the MAC check in this operation fails, then the initiator |
nothing calls this directly
no test coverage detected