+ offers_base_key,
+ offers_encryption_key,
+ }
+ }
+
+ /// Returns an [`HmacEngine`] used to construct [`Offer::metadata`].
+ ///
+ /// [`Offer::metadata`]: crate::offers::offer::Offer::metadata
+ pub(crate) fn hmac_for_offer(
+ &self, nonce: Nonce, iv_bytes: &[u8; IV_LEN]
+ ) -> HmacEngine<Sha256> {
+ let mut hmac = HmacEngine::<Sha256>::new(&self.offers_base_key);
+ hmac.input(iv_bytes);
+ hmac.input(&nonce.0);
+ hmac
+ }
+
+ /// Encrypts or decrypts the given `bytes`. Used for data included in an offer message's
+ /// metadata (e.g., payment id).
+ pub(crate) fn crypt_for_offer(&self, mut bytes: [u8; 32], nonce: Nonce) -> [u8; 32] {
+ ChaCha20::encrypt_single_block_in_place(&self.offers_encryption_key, &nonce.0, &mut bytes);
+ bytes
+ }
+}
+
+/// A 128-bit number used only once.
+///
+/// Needed when constructing [`Offer::metadata`] and deriving [`Offer::signing_pubkey`] from
+/// [`ExpandedKey`]. Must not be reused for any other derivation without first hashing.
+///
+/// [`Offer::metadata`]: crate::offers::offer::Offer::metadata
+/// [`Offer::signing_pubkey`]: crate::offers::offer::Offer::signing_pubkey
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) struct Nonce(pub(crate) [u8; Self::LENGTH]);
+
+impl Nonce {
+ /// Number of bytes in the nonce.
+ pub const LENGTH: usize = 16;
+
+ /// Creates a `Nonce` from the given [`EntropySource`].
+ pub fn from_entropy_source<ES: Deref>(entropy_source: ES) -> Self
+ where
+ ES::Target: EntropySource,
+ {
+ let mut bytes = [0u8; Self::LENGTH];
+ let rand_bytes = entropy_source.get_secure_random_bytes();
+ bytes.copy_from_slice(&rand_bytes[..Self::LENGTH]);
+
+ Nonce(bytes)
+ }
+
+ /// Returns a slice of the underlying bytes of size [`Nonce::LENGTH`].
+ pub fn as_slice(&self) -> &[u8] {
+ &self.0
+ }
+}
+
+impl TryFrom<&[u8]> for Nonce {
+ type Error = ();
+
+ fn try_from(bytes: &[u8]) -> Result<Self, ()> {
+ if bytes.len() != Self::LENGTH {
+ return Err(());