X-Git-Url: http://git.bitcoin.ninja/index.cgi?a=blobdiff_plain;f=lightning%2Fsrc%2Fln%2Fchan_utils.rs;h=c5e36e2d0ceef192094f356cbb1e434fe2868bb7;hb=9d8efecadf4d5f966223b352ffc0a65a8fdfd263;hp=ba175733abeb632065d0cf16fe44ca13b6560b66;hpb=779ff6721bfca42e6a2d218913073997367c7657;p=rust-lightning diff --git a/lightning/src/ln/chan_utils.rs b/lightning/src/ln/chan_utils.rs index ba175733..c5e36e2d 100644 --- a/lightning/src/ln/chan_utils.rs +++ b/lightning/src/ln/chan_utils.rs @@ -1,3 +1,12 @@ +// This file is Copyright its original authors, visible in version control +// history. +// +// This file is licensed under the Apache License, Version 2.0 or the MIT license +// , at your option. +// You may not use this file except in accordance with one or both of these +// licenses. + //! Various utilities for building scripts and deriving keys related to channels. These are //! largely of interest for those implementing chain::keysinterface::ChannelKeys message signing //! by hand. @@ -21,6 +30,7 @@ use util::byte_utils; use bitcoin::secp256k1::key::{SecretKey, PublicKey}; use bitcoin::secp256k1::{Secp256k1, Signature}; +use bitcoin::secp256k1::Error as SecpError; use bitcoin::secp256k1; use std::{cmp, mem}; @@ -267,23 +277,52 @@ pub fn derive_public_revocation_key(secp_ctx: &Secp2 /// The set of public keys which are used in the creation of one commitment transaction. /// These are derived from the channel base keys and per-commitment data. +/// +/// These keys are assumed to be good, either because the code derived them from +/// channel basepoints via the new function, or they were obtained via +/// PreCalculatedTxCreationKeys.trust_key_derivation because we trusted the source of the +/// pre-calculated keys. #[derive(PartialEq, Clone)] pub struct TxCreationKeys { /// The per-commitment public key which was used to derive the other keys. pub per_commitment_point: PublicKey, /// The revocation key which is used to allow the owner of the commitment transaction to /// provide their counterparty the ability to punish them if they broadcast an old state. - pub(crate) revocation_key: PublicKey, + pub revocation_key: PublicKey, /// A's HTLC Key - pub(crate) a_htlc_key: PublicKey, + pub a_htlc_key: PublicKey, /// B's HTLC Key - pub(crate) b_htlc_key: PublicKey, + pub b_htlc_key: PublicKey, /// A's Payment Key (which isn't allowed to be spent from for some delay) - pub(crate) a_delayed_payment_key: PublicKey, + pub a_delayed_payment_key: PublicKey, } impl_writeable!(TxCreationKeys, 33*6, { per_commitment_point, revocation_key, a_htlc_key, b_htlc_key, a_delayed_payment_key }); +/// The per-commitment point and a set of pre-calculated public keys used for transaction creation +/// in the signer. +/// The pre-calculated keys are an optimization, because ChannelKeys has enough +/// information to re-derive them. +pub struct PreCalculatedTxCreationKeys(TxCreationKeys); + +impl PreCalculatedTxCreationKeys { + /// Create a new PreCalculatedTxCreationKeys from TxCreationKeys + pub fn new(keys: TxCreationKeys) -> Self { + PreCalculatedTxCreationKeys(keys) + } + + /// The pre-calculated transaction creation public keys. + /// An external validating signer should not trust these keys. + pub fn trust_key_derivation(&self) -> &TxCreationKeys { + &self.0 + } + + /// The transaction per-commitment point + pub fn per_commitment_point(&self) -> &PublicKey { + &self.0.per_commitment_point + } +} + /// One counterparty's public keys which do not change over the life of a channel. #[derive(Clone, PartialEq)] pub struct ChannelPublicKeys { @@ -318,7 +357,8 @@ impl_writeable!(ChannelPublicKeys, 33*5, { impl TxCreationKeys { - pub(crate) fn new(secp_ctx: &Secp256k1, per_commitment_point: &PublicKey, a_delayed_payment_base: &PublicKey, a_htlc_base: &PublicKey, b_revocation_base: &PublicKey, b_htlc_base: &PublicKey) -> Result { + /// Create a new TxCreationKeys from channel base points and the per-commitment point + pub fn derive_new(secp_ctx: &Secp256k1, per_commitment_point: &PublicKey, a_delayed_payment_base: &PublicKey, a_htlc_base: &PublicKey, b_revocation_base: &PublicKey, b_htlc_base: &PublicKey) -> Result { Ok(TxCreationKeys { per_commitment_point: per_commitment_point.clone(), revocation_key: derive_public_revocation_key(&secp_ctx, &per_commitment_point, &b_revocation_base)?, @@ -510,8 +550,7 @@ pub struct LocalCommitmentTransaction { // Which order the signatures should go in when constructing the final commitment tx witness. // The user should be able to reconstruc this themselves, so we don't bother to expose it. our_sig_first: bool, - /// The key derivation parameters for this commitment transaction - pub local_keys: TxCreationKeys, + pub(crate) local_keys: TxCreationKeys, /// The feerate paid per 1000-weight-unit in this commitment transaction. This value is /// controlled by the channel initiator. pub feerate_per_kw: u32, @@ -561,11 +600,26 @@ impl LocalCommitmentTransaction { } /// Generate a new LocalCommitmentTransaction based on a raw commitment transaction, - /// remote signature and both parties keys - pub(crate) fn new_missing_local_sig(unsigned_tx: Transaction, their_sig: Signature, our_funding_key: &PublicKey, their_funding_key: &PublicKey, local_keys: TxCreationKeys, feerate_per_kw: u32, htlc_data: Vec<(HTLCOutputInCommitment, Option)>) -> LocalCommitmentTransaction { + /// remote signature and both parties keys. + /// + /// The unsigned transaction outputs must be consistent with htlc_data. This function + /// only checks that the shape and amounts are consistent, but does not check the scriptPubkey. + pub fn new_missing_local_sig(unsigned_tx: Transaction, their_sig: Signature, our_funding_key: &PublicKey, their_funding_key: &PublicKey, local_keys: TxCreationKeys, feerate_per_kw: u32, htlc_data: Vec<(HTLCOutputInCommitment, Option)>) -> LocalCommitmentTransaction { if unsigned_tx.input.len() != 1 { panic!("Tried to store a commitment transaction that had input count != 1!"); } if unsigned_tx.input[0].witness.len() != 0 { panic!("Tried to store a signed commitment transaction?"); } + for htlc in &htlc_data { + if let Some(index) = htlc.0.transaction_output_index { + let out = &unsigned_tx.output[index as usize]; + if out.value != htlc.0.amount_msat / 1000 { + panic!("HTLC at index {} has incorrect amount", index); + } + if !out.script_pubkey.is_v0_p2wsh() { + panic!("HTLC at index {} doesn't have p2wsh scriptPubkey", index); + } + } + } + Self { unsigned_tx, their_sig, @@ -576,6 +630,12 @@ impl LocalCommitmentTransaction { } } + /// The pre-calculated transaction creation public keys. + /// An external validating signer should not trust these keys. + pub fn trust_key_derivation(&self) -> &TxCreationKeys { + &self.local_keys + } + /// Get the txid of the local commitment transaction contained in this /// LocalCommitmentTransaction pub fn txid(&self) -> Txid { @@ -591,8 +651,8 @@ impl LocalCommitmentTransaction { /// ChannelKeys::sign_local_commitment() calls directly. /// Channel value is amount locked in funding_outpoint. pub fn get_local_sig(&self, funding_key: &SecretKey, funding_redeemscript: &Script, channel_value_satoshis: u64, secp_ctx: &Secp256k1) -> Signature { - let sighash = hash_to_message!(&bip143::SighashComponents::new(&self.unsigned_tx) - .sighash_all(&self.unsigned_tx.input[0], funding_redeemscript, channel_value_satoshis)[..]); + let sighash = hash_to_message!(&bip143::SigHashCache::new(&self.unsigned_tx) + .signature_hash(0, funding_redeemscript, channel_value_satoshis, SigHashType::All)[..]); secp_ctx.sign(&sighash, funding_key) } @@ -632,7 +692,7 @@ impl LocalCommitmentTransaction { let htlc_redeemscript = get_htlc_redeemscript_with_explicit_keys(&this_htlc.0, &self.local_keys.a_htlc_key, &self.local_keys.b_htlc_key, &self.local_keys.revocation_key); - let sighash = hash_to_message!(&bip143::SighashComponents::new(&htlc_tx).sighash_all(&htlc_tx.input[0], &htlc_redeemscript, this_htlc.0.amount_msat / 1000)[..]); + let sighash = hash_to_message!(&bip143::SigHashCache::new(&htlc_tx).signature_hash(0, &htlc_redeemscript, this_htlc.0.amount_msat / 1000, SigHashType::All)[..]); ret.push(Some(secp_ctx.sign(&sighash, &our_htlc_key))); } else { ret.push(None);