1 use bitcoin::blockdata::script::{Script,Builder};
2 use bitcoin::blockdata::opcodes;
3 use bitcoin::blockdata::transaction::{TxIn,TxOut,OutPoint,Transaction};
5 use bitcoin_hashes::{Hash, HashEngine};
6 use bitcoin_hashes::sha256::Hash as Sha256;
7 use bitcoin_hashes::ripemd160::Hash as Ripemd160;
8 use bitcoin_hashes::hash160::Hash as Hash160;
9 use bitcoin_hashes::sha256d::Hash as Sha256dHash;
11 use ln::channelmanager::PaymentHash;
13 use secp256k1::key::{PublicKey,SecretKey};
14 use secp256k1::Secp256k1;
17 pub const HTLC_SUCCESS_TX_WEIGHT: u64 = 703;
18 pub const HTLC_TIMEOUT_TX_WEIGHT: u64 = 663;
20 // Various functions for key derivation and transaction creation for use within channels. Primarily
21 // used in Channel and ChannelMonitor.
23 pub fn build_commitment_secret(commitment_seed: [u8; 32], idx: u64) -> [u8; 32] {
24 let mut res: [u8; 32] = commitment_seed;
27 if idx & (1 << bitpos) == (1 << bitpos) {
28 res[bitpos / 8] ^= 1 << (bitpos & 7);
29 res = Sha256::hash(&res).into_inner();
35 pub fn derive_private_key<T: secp256k1::Signing>(secp_ctx: &Secp256k1<T>, per_commitment_point: &PublicKey, base_secret: &SecretKey) -> Result<SecretKey, secp256k1::Error> {
36 let mut sha = Sha256::engine();
37 sha.input(&per_commitment_point.serialize());
38 sha.input(&PublicKey::from_secret_key(&secp_ctx, &base_secret).serialize());
39 let res = Sha256::from_engine(sha).into_inner();
41 let mut key = base_secret.clone();
42 key.add_assign(&res)?;
46 pub fn derive_public_key<T: secp256k1::Signing>(secp_ctx: &Secp256k1<T>, per_commitment_point: &PublicKey, base_point: &PublicKey) -> Result<PublicKey, secp256k1::Error> {
47 let mut sha = Sha256::engine();
48 sha.input(&per_commitment_point.serialize());
49 sha.input(&base_point.serialize());
50 let res = Sha256::from_engine(sha).into_inner();
52 let hashkey = PublicKey::from_secret_key(&secp_ctx, &SecretKey::from_slice(&res)?);
53 base_point.combine(&hashkey)
56 /// Derives a revocation key from its constituent parts
57 pub fn derive_private_revocation_key<T: secp256k1::Signing>(secp_ctx: &Secp256k1<T>, per_commitment_secret: &SecretKey, revocation_base_secret: &SecretKey) -> Result<SecretKey, secp256k1::Error> {
58 let revocation_base_point = PublicKey::from_secret_key(&secp_ctx, &revocation_base_secret);
59 let per_commitment_point = PublicKey::from_secret_key(&secp_ctx, &per_commitment_secret);
61 let rev_append_commit_hash_key = {
62 let mut sha = Sha256::engine();
63 sha.input(&revocation_base_point.serialize());
64 sha.input(&per_commitment_point.serialize());
66 Sha256::from_engine(sha).into_inner()
68 let commit_append_rev_hash_key = {
69 let mut sha = Sha256::engine();
70 sha.input(&per_commitment_point.serialize());
71 sha.input(&revocation_base_point.serialize());
73 Sha256::from_engine(sha).into_inner()
76 let mut part_a = revocation_base_secret.clone();
77 part_a.mul_assign(&rev_append_commit_hash_key)?;
78 let mut part_b = per_commitment_secret.clone();
79 part_b.mul_assign(&commit_append_rev_hash_key)?;
80 part_a.add_assign(&part_b[..])?;
84 pub fn derive_public_revocation_key<T: secp256k1::Verification>(secp_ctx: &Secp256k1<T>, per_commitment_point: &PublicKey, revocation_base_point: &PublicKey) -> Result<PublicKey, secp256k1::Error> {
85 let rev_append_commit_hash_key = {
86 let mut sha = Sha256::engine();
87 sha.input(&revocation_base_point.serialize());
88 sha.input(&per_commitment_point.serialize());
90 Sha256::from_engine(sha).into_inner()
92 let commit_append_rev_hash_key = {
93 let mut sha = Sha256::engine();
94 sha.input(&per_commitment_point.serialize());
95 sha.input(&revocation_base_point.serialize());
97 Sha256::from_engine(sha).into_inner()
100 let mut part_a = revocation_base_point.clone();
101 part_a.mul_assign(&secp_ctx, &rev_append_commit_hash_key)?;
102 let mut part_b = per_commitment_point.clone();
103 part_b.mul_assign(&secp_ctx, &commit_append_rev_hash_key)?;
104 part_a.combine(&part_b)
107 pub struct TxCreationKeys {
108 pub per_commitment_point: PublicKey,
109 pub revocation_key: PublicKey,
110 pub a_htlc_key: PublicKey,
111 pub b_htlc_key: PublicKey,
112 pub a_delayed_payment_key: PublicKey,
113 pub b_payment_key: PublicKey,
116 impl TxCreationKeys {
117 pub fn new<T: secp256k1::Signing + secp256k1::Verification>(secp_ctx: &Secp256k1<T>, per_commitment_point: &PublicKey, a_delayed_payment_base: &PublicKey, a_htlc_base: &PublicKey, b_revocation_base: &PublicKey, b_payment_base: &PublicKey, b_htlc_base: &PublicKey) -> Result<TxCreationKeys, secp256k1::Error> {
119 per_commitment_point: per_commitment_point.clone(),
120 revocation_key: derive_public_revocation_key(&secp_ctx, &per_commitment_point, &b_revocation_base)?,
121 a_htlc_key: derive_public_key(&secp_ctx, &per_commitment_point, &a_htlc_base)?,
122 b_htlc_key: derive_public_key(&secp_ctx, &per_commitment_point, &b_htlc_base)?,
123 a_delayed_payment_key: derive_public_key(&secp_ctx, &per_commitment_point, &a_delayed_payment_base)?,
124 b_payment_key: derive_public_key(&secp_ctx, &per_commitment_point, &b_payment_base)?,
129 /// Gets the "to_local" output redeemscript, ie the script which is time-locked or spendable by
130 /// the revocation key
131 pub fn get_revokeable_redeemscript(revocation_key: &PublicKey, to_self_delay: u16, delayed_payment_key: &PublicKey) -> Script {
132 Builder::new().push_opcode(opcodes::all::OP_IF)
133 .push_slice(&revocation_key.serialize())
134 .push_opcode(opcodes::all::OP_ELSE)
135 .push_int(to_self_delay as i64)
136 .push_opcode(opcodes::all::OP_CSV)
137 .push_opcode(opcodes::all::OP_DROP)
138 .push_slice(&delayed_payment_key.serialize())
139 .push_opcode(opcodes::all::OP_ENDIF)
140 .push_opcode(opcodes::all::OP_CHECKSIG)
144 #[derive(Clone, PartialEq)]
145 pub struct HTLCOutputInCommitment {
147 pub amount_msat: u64,
148 pub cltv_expiry: u32,
149 pub payment_hash: PaymentHash,
150 pub transaction_output_index: Option<u32>,
154 pub fn get_htlc_redeemscript_with_explicit_keys(htlc: &HTLCOutputInCommitment, a_htlc_key: &PublicKey, b_htlc_key: &PublicKey, revocation_key: &PublicKey) -> Script {
155 let payment_hash160 = Ripemd160::hash(&htlc.payment_hash.0[..]).into_inner();
157 Builder::new().push_opcode(opcodes::all::OP_DUP)
158 .push_opcode(opcodes::all::OP_HASH160)
159 .push_slice(&Hash160::hash(&revocation_key.serialize())[..])
160 .push_opcode(opcodes::all::OP_EQUAL)
161 .push_opcode(opcodes::all::OP_IF)
162 .push_opcode(opcodes::all::OP_CHECKSIG)
163 .push_opcode(opcodes::all::OP_ELSE)
164 .push_slice(&b_htlc_key.serialize()[..])
165 .push_opcode(opcodes::all::OP_SWAP)
166 .push_opcode(opcodes::all::OP_SIZE)
168 .push_opcode(opcodes::all::OP_EQUAL)
169 .push_opcode(opcodes::all::OP_NOTIF)
170 .push_opcode(opcodes::all::OP_DROP)
172 .push_opcode(opcodes::all::OP_SWAP)
173 .push_slice(&a_htlc_key.serialize()[..])
175 .push_opcode(opcodes::all::OP_CHECKMULTISIG)
176 .push_opcode(opcodes::all::OP_ELSE)
177 .push_opcode(opcodes::all::OP_HASH160)
178 .push_slice(&payment_hash160)
179 .push_opcode(opcodes::all::OP_EQUALVERIFY)
180 .push_opcode(opcodes::all::OP_CHECKSIG)
181 .push_opcode(opcodes::all::OP_ENDIF)
182 .push_opcode(opcodes::all::OP_ENDIF)
185 Builder::new().push_opcode(opcodes::all::OP_DUP)
186 .push_opcode(opcodes::all::OP_HASH160)
187 .push_slice(&Hash160::hash(&revocation_key.serialize())[..])
188 .push_opcode(opcodes::all::OP_EQUAL)
189 .push_opcode(opcodes::all::OP_IF)
190 .push_opcode(opcodes::all::OP_CHECKSIG)
191 .push_opcode(opcodes::all::OP_ELSE)
192 .push_slice(&b_htlc_key.serialize()[..])
193 .push_opcode(opcodes::all::OP_SWAP)
194 .push_opcode(opcodes::all::OP_SIZE)
196 .push_opcode(opcodes::all::OP_EQUAL)
197 .push_opcode(opcodes::all::OP_IF)
198 .push_opcode(opcodes::all::OP_HASH160)
199 .push_slice(&payment_hash160)
200 .push_opcode(opcodes::all::OP_EQUALVERIFY)
202 .push_opcode(opcodes::all::OP_SWAP)
203 .push_slice(&a_htlc_key.serialize()[..])
205 .push_opcode(opcodes::all::OP_CHECKMULTISIG)
206 .push_opcode(opcodes::all::OP_ELSE)
207 .push_opcode(opcodes::all::OP_DROP)
208 .push_int(htlc.cltv_expiry as i64)
209 .push_opcode(opcodes::all::OP_CLTV)
210 .push_opcode(opcodes::all::OP_DROP)
211 .push_opcode(opcodes::all::OP_CHECKSIG)
212 .push_opcode(opcodes::all::OP_ENDIF)
213 .push_opcode(opcodes::all::OP_ENDIF)
218 /// note here that 'a_revocation_key' is generated using b_revocation_basepoint and a's
219 /// commitment secret. 'htlc' does *not* need to have its previous_output_index filled.
221 pub fn get_htlc_redeemscript(htlc: &HTLCOutputInCommitment, keys: &TxCreationKeys) -> Script {
222 get_htlc_redeemscript_with_explicit_keys(htlc, &keys.a_htlc_key, &keys.b_htlc_key, &keys.revocation_key)
225 /// panics if htlc.transaction_output_index.is_none()!
226 pub fn build_htlc_transaction(prev_hash: &Sha256dHash, feerate_per_kw: u64, to_self_delay: u16, htlc: &HTLCOutputInCommitment, a_delayed_payment_key: &PublicKey, revocation_key: &PublicKey) -> Transaction {
227 let mut txins: Vec<TxIn> = Vec::new();
229 previous_output: OutPoint {
230 txid: prev_hash.clone(),
231 vout: htlc.transaction_output_index.expect("Can't build an HTLC transaction for a dust output"),
233 script_sig: Script::new(),
238 let total_fee = if htlc.offered {
239 feerate_per_kw * HTLC_TIMEOUT_TX_WEIGHT / 1000
241 feerate_per_kw * HTLC_SUCCESS_TX_WEIGHT / 1000
244 let mut txouts: Vec<TxOut> = Vec::new();
246 script_pubkey: get_revokeable_redeemscript(revocation_key, to_self_delay, a_delayed_payment_key).to_v0_p2wsh(),
247 value: htlc.amount_msat / 1000 - total_fee //TODO: BOLT 3 does not specify if we should add amount_msat before dividing or if we should divide by 1000 before subtracting (as we do here)
252 lock_time: if htlc.offered { htlc.cltv_expiry } else { 0 },