use bitcoin::blockdata::opcodes;
use bitcoin::network::constants::Network;
use bitcoin::util::bip32::{ExtendedPrivKey, ExtendedPubKey, ChildNumber};
-use bitcoin::util::address::Address;
use bitcoin::util::bip143;
use bitcoin::hashes::{Hash, HashEngine};
use ln::chan_utils;
use ln::chan_utils::{TxCreationKeys, HTLCOutputInCommitment, make_funding_redeemscript, ChannelPublicKeys, LocalCommitmentTransaction};
use ln::msgs;
-use ln::channelmanager::PaymentPreimage;
use std::sync::atomic::{AtomicUsize, Ordering};
use std::io::Error;
/// <BIP 143 signature> <empty vector> (MINIMALIF standard rule) <provided witnessScript>
///
/// Note that the nSequence field in the spending input must be set to to_self_delay
- /// (which means the transaction not being broadcastable until at least to_self_delay
+ /// (which means the transaction is not broadcastable until at least to_self_delay
/// blocks after the outpoint confirms).
///
/// These are generally the result of a "revocable" output to us, spendable only by us unless
- /// it is an output from us having broadcast an old state (which should never happen).
+ /// it is an output from an old state which we broadcast (which should never happen).
///
- /// WitnessScript may be regenerated by passing the revocation_pubkey, to_self_delay and
- /// delayed_payment_pubkey to chan_utils::get_revokeable_redeemscript.
+ /// To derive the delayed_payment key which is used to sign for this input, you must pass the
+ /// local delayed_payment_base_key (ie the private key which corresponds to the pubkey in
+ /// ChannelKeys::pubkeys().delayed_payment_basepoint) and the provided per_commitment_point to
+ /// chan_utils::derive_private_key. The public key can be generated without the secret key
+ /// using chan_utils::derive_public_key and only the delayed_payment_basepoint which appears in
+ /// ChannelKeys::pubkeys().
///
- /// To derive the delayed_payment key corresponding to the channel state, you must pass the
- /// channel's delayed_payment_key and the provided per_commitment_point to
- /// chan_utils::derive_private_key. The resulting key should be used to sign the spending
- /// transaction.
+ /// To derive the remote_revocation_pubkey provided here (which is used in the witness
+ /// script generation), you must pass the remote revocation_basepoint (which appears in the
+ /// call to ChannelKeys::set_remote_channel_pubkeys) and the provided per_commitment point
+ /// to chan_utils::derive_public_revocation_key.
+ ///
+ /// The witness script which is hashed and included in the output script_pubkey may be
+ /// regenerated by passing the revocation_pubkey (derived as above), our delayed_payment pubkey
+ /// (derived as above), and the to_self_delay contained here to
+ /// chan_utils::get_revokeable_redeemscript.
+ //
+ // TODO: we need to expose utility methods in KeyManager to do all the relevant derivation.
DynamicOutputP2WSH {
/// The outpoint which is spendable
outpoint: OutPoint,
/// The remote_revocation_pubkey used to derive witnessScript
remote_revocation_pubkey: PublicKey
},
- // TODO: Note that because key is now static and exactly what is provided by us, we should drop
- // this in favor of StaticOutput:
- /// An output to a P2WPKH, spendable exclusively by the given private key.
+ /// An output to a P2WPKH, spendable exclusively by our payment key (ie the private key which
+ /// corresponds to the public key in ChannelKeys::pubkeys().payment_point).
/// The witness in the spending input, is, thus, simply:
/// <BIP 143 signature> <payment key>
///
/// These are generally the result of our counterparty having broadcast the current state,
/// allowing us to claim the non-HTLC-encumbered outputs immediately.
- ///
- /// To derive the payment key corresponding to the channel state, you must pass the
- /// channel's payment_base_key and the provided per_commitment_point to
- /// chan_utils::derive_private_key. The resulting key should be used to sign the spending
- /// transaction.
- DynamicOutputP2WPKH {
+ StaticOutputRemotePayment {
/// The outpoint which is spendable
outpoint: OutPoint,
/// The output which is reference by the given outpoint
key_derivation_params.1.write(writer)?;
remote_revocation_pubkey.write(writer)?;
},
- &SpendableOutputDescriptor::DynamicOutputP2WPKH { ref outpoint, ref output, ref key_derivation_params } => {
+ &SpendableOutputDescriptor::StaticOutputRemotePayment { ref outpoint, ref output, ref key_derivation_params } => {
2u8.write(writer)?;
outpoint.write(writer)?;
output.write(writer)?;
key_derivation_params: (Readable::read(reader)?, Readable::read(reader)?),
remote_revocation_pubkey: Readable::read(reader)?,
}),
- 2u8 => Ok(SpendableOutputDescriptor::DynamicOutputP2WPKH {
+ 2u8 => Ok(SpendableOutputDescriptor::StaticOutputRemotePayment {
outpoint: Readable::read(reader)?,
output: Readable::read(reader)?,
key_derivation_params: (Readable::read(reader)?, Readable::read(reader)?),
/// return value must contain a signature.
fn sign_local_commitment_htlc_transactions<T: secp256k1::Signing + secp256k1::Verification>(&self, local_commitment_tx: &LocalCommitmentTransaction, local_csv: u16, secp_ctx: &Secp256k1<T>) -> Result<Vec<Option<Signature>>, ()>;
- /// Create a signature for a transaction spending an HTLC or commitment transaction output
- /// when our counterparty broadcast an old state.
+ /// Create a signature for the given input in a transaction spending an HTLC or commitment
+ /// transaction output when our counterparty broadcasts an old state.
///
- /// Justice transaction may claim multiples outputs at same time if timelock are similar.
+ /// A justice transaction may claim multiples outputs at the same time if timelocks are
+ /// similar, but only a signature for the input at index `input` should be signed for here.
/// It may be called multiples time for same output(s) if a fee-bump is needed with regards
/// to an upcoming timelock expiration.
///
- /// Witness_script is a revokable witness script as defined in BOLT3 for `to_local`/HTLC
- /// outputs.
+ /// Amount is value of the output spent by this input, committed to in the BIP 143 signature.
///
- /// Input index is a pointer towards outpoint spent, commited by sigs (BIP 143).
+ /// per_commitment_key is revocation secret which was provided by our counterparty when they
+ /// revoked the state which they eventually broadcast. It's not a _local_ secret key and does
+ /// not allow the spending of any funds by itself (you need our local revocation_secret to do
+ /// so).
///
- /// Amount is value of the output spent by this input, committed by sigs (BIP 143).
+ /// htlc holds HTLC elements (hash, timelock) if the output being spent is a HTLC output, thus
+ /// changing the format of the witness script (which is committed to in the BIP 143
+ /// signatures).
///
- /// Per_commitment key is revocation secret such as provided by remote party while
- /// revocating detected onchain transaction. It's not a _local_ secret key, therefore
- /// it may cross interfaces, a node compromise won't allow to spend revoked output without
- /// also compromissing revocation key.
- //TODO: dry-up witness_script and pass pubkeys
- fn sign_justice_transaction<T: secp256k1::Signing>(&self, justice_tx: &Transaction, input: usize, witness_script: &Script, amount: u64, per_commitment_key: &SecretKey, revocation_pubkey: &PublicKey, is_htlc: bool, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()>;
+ /// on_remote_tx_csv is the relative lock-time that that our counterparty would have to set on
+ /// their transaction were they to spend the same output. It is included in the witness script
+ /// and thus committed to in the BIP 143 signature.
+ fn sign_justice_transaction<T: secp256k1::Signing + secp256k1::Verification>(&self, justice_tx: &Transaction, input: usize, amount: u64, per_commitment_key: &SecretKey, htlc: &Option<HTLCOutputInCommitment>, on_remote_tx_csv: u16, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()>;
/// Create a signature for a claiming transaction for a HTLC output on a remote commitment
/// transaction, either offered or received.
///
- /// HTLC transaction may claim multiples offered outputs at same time if we know preimage
- /// for each at detection. It may be called multtiples time for same output(s) if a fee-bump
- /// is needed with regards to an upcoming timelock expiration.
+ /// Such a transaction may claim multiples offered outputs at same time if we know the
+ /// preimage for each when we create it, but only the input at index `input` should be
+ /// signed for here. It may be called multiple times for same output(s) if a fee-bump is
+ /// needed with regards to an upcoming timelock expiration.
///
/// Witness_script is either a offered or received script as defined in BOLT3 for HTLC
/// outputs.
///
- /// Input index is a pointer towards outpoint spent, commited by sigs (BIP 143).
+ /// Amount is value of the output spent by this input, committed to in the BIP 143 signature.
///
- /// Amount is value of the output spent by this input, committed by sigs (BIP 143).
- ///
- /// Preimage is solution for an offered HTLC haslock. A preimage sets to None hints this
- /// htlc_tx as timing-out funds back to us on a received output.
- //TODO: dry-up witness_script and pass pubkeys
- fn sign_remote_htlc_transaction<T: secp256k1::Signing>(&self, htlc_tx: &Transaction, input: usize, witness_script: &Script, amount: u64, per_commitment_point: &PublicKey, preimage: &Option<PaymentPreimage>, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()>;
+ /// Per_commitment_point is the dynamic point corresponding to the channel state
+ /// detected onchain. It has been generated by our counterparty and is used to derive
+ /// channel state keys, which are then included in the witness script and committed to in the
+ /// BIP 143 signature.
+ fn sign_remote_htlc_transaction<T: secp256k1::Signing + secp256k1::Verification>(&self, htlc_tx: &Transaction, input: usize, amount: u64, per_commitment_point: &PublicKey, htlc: &HTLCOutputInCommitment, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()>;
/// Create a signature for a (proposed) closing transaction.
///
local_commitment_tx.get_htlc_sigs(&self.htlc_base_key, local_csv, secp_ctx)
}
- fn sign_justice_transaction<T: secp256k1::Signing>(&self, justice_tx: &Transaction, input: usize, witness_script: &Script, amount: u64, per_commitment_key: &SecretKey, revocation_pubkey: &PublicKey, is_htlc: bool, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()> {
- if let Ok(revocation_key) = chan_utils::derive_private_revocation_key(&secp_ctx, &per_commitment_key, &self.revocation_base_key) {
- let sighash_parts = bip143::SighashComponents::new(&justice_tx);
- let sighash = hash_to_message!(&sighash_parts.sighash_all(&justice_tx.input[input], &witness_script, amount)[..]);
- return Ok(secp_ctx.sign(&sighash, &revocation_key))
- }
- Err(())
+ fn sign_justice_transaction<T: secp256k1::Signing + secp256k1::Verification>(&self, justice_tx: &Transaction, input: usize, amount: u64, per_commitment_key: &SecretKey, htlc: &Option<HTLCOutputInCommitment>, on_remote_tx_csv: u16, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()> {
+ let revocation_key = match chan_utils::derive_private_revocation_key(&secp_ctx, &per_commitment_key, &self.revocation_base_key) {
+ Ok(revocation_key) => revocation_key,
+ Err(_) => return Err(())
+ };
+ let per_commitment_point = PublicKey::from_secret_key(secp_ctx, &per_commitment_key);
+ let revocation_pubkey = match chan_utils::derive_public_revocation_key(&secp_ctx, &per_commitment_point, &self.pubkeys().revocation_basepoint) {
+ Ok(revocation_pubkey) => revocation_pubkey,
+ Err(_) => return Err(())
+ };
+ let witness_script = if let &Some(ref htlc) = htlc {
+ let remote_htlcpubkey = match chan_utils::derive_public_key(&secp_ctx, &per_commitment_point, &self.remote_pubkeys().htlc_basepoint) {
+ Ok(remote_htlcpubkey) => remote_htlcpubkey,
+ Err(_) => return Err(())
+ };
+ let local_htlcpubkey = match chan_utils::derive_public_key(&secp_ctx, &per_commitment_point, &self.pubkeys().htlc_basepoint) {
+ Ok(local_htlcpubkey) => local_htlcpubkey,
+ Err(_) => return Err(())
+ };
+ chan_utils::get_htlc_redeemscript_with_explicit_keys(&htlc, &remote_htlcpubkey, &local_htlcpubkey, &revocation_pubkey)
+ } else {
+ let remote_delayedpubkey = match chan_utils::derive_public_key(&secp_ctx, &per_commitment_point, &self.remote_pubkeys().delayed_payment_basepoint) {
+ Ok(remote_delayedpubkey) => remote_delayedpubkey,
+ Err(_) => return Err(())
+ };
+ chan_utils::get_revokeable_redeemscript(&revocation_pubkey, on_remote_tx_csv, &remote_delayedpubkey)
+ };
+ let sighash_parts = bip143::SighashComponents::new(&justice_tx);
+ let sighash = hash_to_message!(&sighash_parts.sighash_all(&justice_tx.input[input], &witness_script, amount)[..]);
+ return Ok(secp_ctx.sign(&sighash, &revocation_key))
}
- fn sign_remote_htlc_transaction<T: secp256k1::Signing>(&self, htlc_tx: &Transaction, input: usize, witness_script: &Script, amount: u64, per_commitment_point: &PublicKey, preimage: &Option<PaymentPreimage>, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()> {
+ fn sign_remote_htlc_transaction<T: secp256k1::Signing + secp256k1::Verification>(&self, htlc_tx: &Transaction, input: usize, amount: u64, per_commitment_point: &PublicKey, htlc: &HTLCOutputInCommitment, secp_ctx: &Secp256k1<T>) -> Result<Signature, ()> {
if let Ok(htlc_key) = chan_utils::derive_private_key(&secp_ctx, &per_commitment_point, &self.htlc_base_key) {
+ let witness_script = if let Ok(revocation_pubkey) = chan_utils::derive_public_revocation_key(&secp_ctx, &per_commitment_point, &self.pubkeys().revocation_basepoint) {
+ if let Ok(remote_htlcpubkey) = chan_utils::derive_public_key(&secp_ctx, &per_commitment_point, &self.remote_pubkeys().htlc_basepoint) {
+ if let Ok(local_htlcpubkey) = chan_utils::derive_public_key(&secp_ctx, &per_commitment_point, &self.pubkeys().htlc_basepoint) {
+ chan_utils::get_htlc_redeemscript_with_explicit_keys(&htlc, &remote_htlcpubkey, &local_htlcpubkey, &revocation_pubkey)
+ } else { return Err(()) }
+ } else { return Err(()) }
+ } else { return Err(()) };
let sighash_parts = bip143::SighashComponents::new(&htlc_tx);
let sighash = hash_to_message!(&sighash_parts.sighash_all(&htlc_tx.input[input], &witness_script, amount)[..]);
return Ok(secp_ctx.sign(&sighash, &htlc_key))
projects / rust-lightning / blobdiff