BOLT #3: * * The corresponding private key can be derived once the `per_commitment_secret` * is known: * * revocationprivkey = revocation_basepoint_secret * SHA256(revocation_basepoint || per_commitment_point) + per_commitment_secret * SHA256(per_commitment_point || revocation_basepoint) */
| 192 | * revocationprivkey = revocation_basepoint_secret * SHA256(revocation_basepoint || per_commitment_point) + per_commitment_secret * SHA256(per_commitment_point || revocation_basepoint) |
| 193 | */ |
| 194 | bool derive_revocation_privkey(const struct secret *base_secret, |
| 195 | const struct secret *per_commitment_secret, |
| 196 | const struct pubkey *basepoint, |
| 197 | const struct pubkey *per_commitment_point, |
| 198 | struct privkey *key) |
| 199 | { |
| 200 | struct sha256 sha; |
| 201 | unsigned char der_keys[PUBKEY_CMPR_LEN * 2]; |
| 202 | struct secret part2; |
| 203 | |
| 204 | pubkey_to_der(der_keys, basepoint); |
| 205 | pubkey_to_der(der_keys + PUBKEY_CMPR_LEN, per_commitment_point); |
| 206 | sha256(&sha, der_keys, sizeof(der_keys)); |
| 207 | #ifdef SUPERVERBOSE |
| 208 | printf("# SHA256(revocation_basepoint || per_commitment_point)\n"); |
| 209 | printf("# => SHA256(0x%s || 0x%s)\n", |
| 210 | tal_hexstr(tmpctx, der_keys, PUBKEY_CMPR_LEN), |
| 211 | tal_hexstr(tmpctx, der_keys + PUBKEY_CMPR_LEN, PUBKEY_CMPR_LEN)); |
| 212 | printf("# = 0x%s\n", tal_hexstr(tmpctx, sha.u.u8, sizeof(sha.u.u8))), |
| 213 | #endif |
| 214 | |
| 215 | key->secret = *base_secret; |
| 216 | if (secp256k1_ec_seckey_tweak_mul(secp256k1_ctx, key->secret.data, |
| 217 | sha.u.u8) |
| 218 | != 1) |
| 219 | return false; |
| 220 | #ifdef SUPERVERBOSE |
| 221 | printf("# * revocation_basepoint_secret (0x%s)", |
| 222 | tal_hexstr(tmpctx, base_secret, sizeof(*base_secret))), |
| 223 | printf("# = 0x%s\n", tal_hexstr(tmpctx, key, sizeof(*key))), |
| 224 | #endif |
| 225 | |
| 226 | pubkey_to_der(der_keys, per_commitment_point); |
| 227 | pubkey_to_der(der_keys + PUBKEY_CMPR_LEN, basepoint); |
| 228 | sha256(&sha, der_keys, sizeof(der_keys)); |
| 229 | #ifdef SUPERVERBOSE |
| 230 | printf("# SHA256(per_commitment_point || revocation_basepoint)\n"); |
| 231 | printf("# => SHA256(0x%s || 0x%s)\n", |
| 232 | tal_hexstr(tmpctx, der_keys, PUBKEY_CMPR_LEN), |
| 233 | tal_hexstr(tmpctx, der_keys + PUBKEY_CMPR_LEN, PUBKEY_CMPR_LEN)); |
| 234 | printf("# = 0x%s\n", tal_hexstr(tmpctx, sha.u.u8, sizeof(sha.u.u8))), |
| 235 | #endif |
| 236 | |
| 237 | part2 = *per_commitment_secret; |
| 238 | if (secp256k1_ec_seckey_tweak_mul(secp256k1_ctx, part2.data, |
| 239 | sha.u.u8) != 1) |
| 240 | return false; |
| 241 | #ifdef SUPERVERBOSE |
| 242 | printf("# * per_commitment_secret (0x%s)", |
| 243 | tal_hexstr(tmpctx, per_commitment_secret, |
| 244 | sizeof(*per_commitment_secret))), |
| 245 | printf("# = 0x%s\n", tal_hexstr(tmpctx, &part2, sizeof(part2))); |
| 246 | #endif |
| 247 | |
| 248 | if (secp256k1_ec_seckey_tweak_add(secp256k1_ctx, key->secret.data, |
| 249 | part2.data) != 1) |
| 250 | return false; |
| 251 |