| 31 | } |
| 32 | |
| 33 | static void maybe_rotate_key(u64 *n, struct secret *k, struct secret *ck) |
| 34 | { |
| 35 | struct secret new_k, new_ck; |
| 36 | |
| 37 | /* BOLT #8: |
| 38 | * |
| 39 | * A key is to be rotated after a party encrypts or decrypts 1000 times |
| 40 | * with it (i.e. every 500 messages). This can be properly accounted |
| 41 | * for by rotating the key once the nonce dedicated to it |
| 42 | * reaches 1000. |
| 43 | */ |
| 44 | if (*n != 1000) |
| 45 | return; |
| 46 | |
| 47 | /* BOLT #8: |
| 48 | * |
| 49 | * Key rotation for a key `k` is performed according to the following |
| 50 | * steps: |
| 51 | * |
| 52 | * 1. Let `ck` be the chaining key (i.e. `rck` for `rk` or `sck` for `sk`) |
| 53 | * 2. `ck', k' = HKDF(ck, k)` |
| 54 | * 3. Reset the nonce for the key to `n = 0`. |
| 55 | * 4. `k = k'` |
| 56 | * 5. `ck = ck'` |
| 57 | */ |
| 58 | hkdf_two_keys(&new_ck, &new_k, ck, k); |
| 59 | #ifdef SUPERVERBOSE |
| 60 | status_debug("# 0x%s, 0x%s = HKDF(0x%s, 0x%s)", |
| 61 | tal_hexstr(trc, &new_ck, sizeof(new_ck)), |
| 62 | tal_hexstr(trc, &new_k, sizeof(new_k)), |
| 63 | tal_hexstr(trc, ck, sizeof(*ck)), |
| 64 | tal_hexstr(trc, k, sizeof(*k))); |
| 65 | #endif |
| 66 | *ck = new_ck; |
| 67 | *k = new_k; |
| 68 | *n = 0; |
| 69 | } |
| 70 | |
| 71 | static void le64_nonce(unsigned char *npub, u64 nonce) |
| 72 | { |
no test coverage detected