Switch Sha256 to using bitcoin_hashes and our own HKDF

[rust-lightning] / src / chain / keysinterface.rs

diff --git a/src/chain/keysinterface.rs b/src/chain/keysinterface.rs
index 4e35e6764d246ced9b431ad473bfe84bf13ecb7f..390b0cc5afebac8f696157924ebd065236b392ea 100644 (file)
--- a/src/chain/keysinterface.rs
+++ b/src/chain/keysinterface.rs
@@ -9,14 +9,13 @@ use bitcoin::network::constants::Network;
 use bitcoin::util::hash::Hash160;
 use bitcoin::util::bip32::{ExtendedPrivKey, ExtendedPubKey, ChildNumber};
 
+use bitcoin_hashes::{Hash, HashEngine};
+use bitcoin_hashes::sha256::Hash as Sha256;
+
 use secp256k1::key::{SecretKey, PublicKey};
 use secp256k1::Secp256k1;
 use secp256k1;
 
-use crypto::hkdf::{hkdf_extract,hkdf_expand};
-use crypto::digest::Digest;
-
-use util::sha2::Sha256;
 use util::logger::Logger;
 use util::rng;
 use util::byte_utils;
@@ -109,43 +108,6 @@ impl_writeable!(ChannelKeys, 0, {
        commitment_seed
 });
 
-impl ChannelKeys {
-       /// Generate a set of lightning keys needed to operate a channel by HKDF-expanding a given
-       /// random 32-byte seed
-       pub fn new_from_seed(seed: &[u8; 32]) -> ChannelKeys {
-               let mut prk = [0; 32];
-               hkdf_extract(Sha256::new(), b"rust-lightning key gen salt", seed, &mut prk);
-               let secp_ctx = Secp256k1::without_caps();
-
-               let mut okm = [0; 32];
-               hkdf_expand(Sha256::new(), &prk, b"rust-lightning funding key info", &mut okm);
-               let funding_key = SecretKey::from_slice(&secp_ctx, &okm).expect("Sha256 is broken");
-
-               hkdf_expand(Sha256::new(), &prk, b"rust-lightning revocation base key info", &mut okm);
-               let revocation_base_key = SecretKey::from_slice(&secp_ctx, &okm).expect("Sha256 is broken");
-
-               hkdf_expand(Sha256::new(), &prk, b"rust-lightning payment base key info", &mut okm);
-               let payment_base_key = SecretKey::from_slice(&secp_ctx, &okm).expect("Sha256 is broken");
-
-               hkdf_expand(Sha256::new(), &prk, b"rust-lightning delayed payment base key info", &mut okm);
-               let delayed_payment_base_key = SecretKey::from_slice(&secp_ctx, &okm).expect("Sha256 is broken");
-
-               hkdf_expand(Sha256::new(), &prk, b"rust-lightning htlc base key info", &mut okm);
-               let htlc_base_key = SecretKey::from_slice(&secp_ctx, &okm).expect("Sha256 is broken");
-
-               hkdf_expand(Sha256::new(), &prk, b"rust-lightning local commitment seed info", &mut okm);
-
-               ChannelKeys {
-                       funding_key: funding_key,
-                       revocation_base_key: revocation_base_key,
-                       payment_base_key: payment_base_key,
-                       delayed_payment_base_key: delayed_payment_base_key,
-                       htlc_base_key: htlc_base_key,
-                       commitment_seed: okm
-               }
-       }
-}
-
 /// Simple KeysInterface implementor that takes a 32-byte seed for use as a BIP 32 extended key
 /// and derives keys from that.
 ///
@@ -225,7 +187,7 @@ impl KeysInterface for KeysManager {
                // entropy, everything else just ensures uniqueness. We generally don't expect
                // all clients to have non-broken RNGs here, so we also include the current
                // time as a fallback to get uniqueness.
-               let mut sha = Sha256::new();
+               let mut sha = Sha256::engine();
 
                let mut seed = [0u8; 32];
                rng::fill_bytes(&mut seed[..]);
@@ -239,13 +201,41 @@ impl KeysInterface for KeysManager {
                let child_privkey = self.channel_master_key.ckd_priv(&self.secp_ctx, ChildNumber::from_hardened_idx(child_ix as u32)).expect("Your RNG is busted");
                sha.input(&child_privkey.secret_key[..]);
 
-               sha.result(&mut seed);
-               ChannelKeys::new_from_seed(&seed)
+               seed = Sha256::from_engine(sha).into_inner();
+
+               let commitment_seed = {
+                       let mut sha = Sha256::engine();
+                       sha.input(&seed);
+                       sha.input(&b"commitment seed"[..]);
+                       Sha256::from_engine(sha).into_inner()
+               };
+               macro_rules! key_step {
+                       ($info: expr, $prev_key: expr) => {{
+                               let mut sha = Sha256::engine();
+                               sha.input(&seed);
+                               sha.input(&$prev_key[..]);
+                               sha.input(&$info[..]);
+                               SecretKey::from_slice(&self.secp_ctx, &Sha256::from_engine(sha).into_inner()).expect("SHA-256 is busted")
+                       }}
+               }
+               let funding_key = key_step!(b"funding key", commitment_seed);
+               let revocation_base_key = key_step!(b"revocation base key", funding_key);
+               let payment_base_key = key_step!(b"payment base key", revocation_base_key);
+               let delayed_payment_base_key = key_step!(b"delayed payment base key", payment_base_key);
+               let htlc_base_key = key_step!(b"HTLC base key", delayed_payment_base_key);
+
+               ChannelKeys {
+                       funding_key,
+                       revocation_base_key,
+                       payment_base_key,
+                       delayed_payment_base_key,
+                       htlc_base_key,
+                       commitment_seed,
+               }
        }
 
        fn get_session_key(&self) -> SecretKey {
-               let mut sha = Sha256::new();
-               let mut res = [0u8; 32];
+               let mut sha = Sha256::engine();
 
                let now = SystemTime::now().duration_since(UNIX_EPOCH).expect("Time went backwards");
                sha.input(&byte_utils::be32_to_array(now.subsec_nanos()));
@@ -254,7 +244,6 @@ impl KeysInterface for KeysManager {
                let child_ix = self.session_child_index.fetch_add(1, Ordering::AcqRel);
                let child_privkey = self.session_master_key.ckd_priv(&self.secp_ctx, ChildNumber::from_hardened_idx(child_ix as u32)).expect("Your RNG is busted");
                sha.input(&child_privkey.secret_key[..]);
-               sha.result(&mut res);
-               SecretKey::from_slice(&self.secp_ctx, &res).expect("Your RNG is busted")
+               SecretKey::from_slice(&self.secp_ctx, &Sha256::from_engine(sha).into_inner()).expect("Your RNG is busted")
        }
 }