| | | 1 | | using NBitcoin; |
| | | 2 | | using NBitcoin.Secp256k1; |
| | | 3 | | |
| | | 4 | | namespace NLightning.Infrastructure.Protocol.Services; |
| | | 5 | | |
| | | 6 | | using Crypto.Contexts; |
| | | 7 | | using Crypto.Hashes; |
| | | 8 | | using Domain.Crypto.Constants; |
| | | 9 | | using Domain.Protocol.Services; |
| | | 10 | | |
| | | 11 | | public class KeyDerivationService : IKeyDerivationService |
| | | 12 | | { |
| | | 13 | | /// <summary> |
| | | 14 | | /// Derives a public key using the formula: basepoint + SHA256(per_commitment_point || basepoint) * G |
| | | 15 | | /// </summary> |
| | | 16 | | public PubKey DerivePublicKey(PubKey basepoint, PubKey perCommitmentPoint) |
| | | 17 | | { |
| | | 18 | | // Calculate SHA256(per_commitment_point || basepoint) |
| | 4 | 19 | | Span<byte> hashBytes = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| | 4 | 20 | | ComputeSha256(perCommitmentPoint, basepoint, hashBytes); |
| | | 21 | | |
| | | 22 | | // Create a private key from the hash (this represents the scalar value) |
| | 4 | 23 | | var hashPrivateKey = new Key(hashBytes.ToArray()); |
| | | 24 | | |
| | | 25 | | // Get the EC point representation of hash*G |
| | 4 | 26 | | var hashPoint = hashPrivateKey.PubKey; |
| | | 27 | | |
| | | 28 | | // Add the base point to the hash point (EC point addition) |
| | | 29 | | // NBitcoin doesn't have direct point addition, so we use a trick with BIP32 derivation |
| | 4 | 30 | | return AddPubKeys(basepoint, hashPoint); |
| | | 31 | | } |
| | | 32 | | |
| | | 33 | | /// <summary> |
| | | 34 | | /// Derives a private key using the formula: basepoint_secret + SHA256(per_commitment_point || basepoint) |
| | | 35 | | /// </summary> |
| | | 36 | | public Key DerivePrivateKey(Key basepointSecret, PubKey perCommitmentPoint) |
| | | 37 | | { |
| | 4 | 38 | | var basepoint = basepointSecret.PubKey; |
| | 4 | 39 | | Span<byte> hashBytes = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| | 4 | 40 | | ComputeSha256(perCommitmentPoint, basepoint, hashBytes); |
| | | 41 | | |
| | | 42 | | // Create a private key from the hash |
| | 4 | 43 | | var hashPrivateKey = new Key(hashBytes.ToArray()); |
| | | 44 | | |
| | | 45 | | // Combine the two private keys |
| | 4 | 46 | | return AddPrivateKeys(basepointSecret, hashPrivateKey); |
| | | 47 | | } |
| | | 48 | | |
| | | 49 | | /// <summary> |
| | | 50 | | /// Derives the revocation public key |
| | | 51 | | /// </summary> |
| | | 52 | | public PubKey DeriveRevocationPubKey(PubKey revocationBasepoint, PubKey perCommitmentPoint) |
| | | 53 | | { |
| | 4 | 54 | | Span<byte> hash1 = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| | 4 | 55 | | Span<byte> hash2 = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| | 4 | 56 | | ComputeSha256(revocationBasepoint, perCommitmentPoint, hash1); |
| | 4 | 57 | | ComputeSha256(perCommitmentPoint, revocationBasepoint, hash2); |
| | | 58 | | |
| | | 59 | | // Calculate revocation_basepoint * SHA256(revocation_basepoint || per_commitment_point) |
| | 4 | 60 | | var term1PrivKey = new Key(hash1.ToArray()); |
| | 4 | 61 | | var term1 = MultiplyPubKey(revocationBasepoint, term1PrivKey.ToBytes()); |
| | | 62 | | |
| | | 63 | | // Calculate per_commitment_point * SHA256(per_commitment_point || revocation_basepoint) |
| | 4 | 64 | | var term2PrivKey = new Key(hash2.ToArray()); |
| | 4 | 65 | | var term2 = MultiplyPubKey(perCommitmentPoint, term2PrivKey.ToBytes()); |
| | | 66 | | |
| | | 67 | | // Add the two terms |
| | 4 | 68 | | return AddPubKeys(term1, term2); |
| | | 69 | | } |
| | | 70 | | |
| | | 71 | | /// <summary> |
| | | 72 | | /// Derives the revocation private key when both secrets are known |
| | | 73 | | /// </summary> |
| | | 74 | | public Key DeriveRevocationPrivKey(Key revocationBasepointSecret, Key perCommitmentSecret) |
| | | 75 | | { |
| | 4 | 76 | | var revocationBasepoint = revocationBasepointSecret.PubKey; |
| | 4 | 77 | | var perCommitmentPoint = perCommitmentSecret.PubKey; |
| | | 78 | | |
| | 4 | 79 | | Span<byte> hash1 = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| | 4 | 80 | | Span<byte> hash2 = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| | 4 | 81 | | ComputeSha256(revocationBasepoint, perCommitmentPoint, hash1); |
| | 4 | 82 | | ComputeSha256(perCommitmentPoint, revocationBasepoint, hash2); |
| | | 83 | | |
| | | 84 | | // Calculate revocation_basepoint_secret * SHA256(revocation_basepoint || per_commitment_point) |
| | 4 | 85 | | var term1 = MultiplyPrivateKey(revocationBasepointSecret, hash1.ToArray()); |
| | | 86 | | |
| | | 87 | | // Calculate per_commitment_secret * SHA256(per_commitment_point || revocation_basepoint) |
| | 4 | 88 | | var term2 = MultiplyPrivateKey(perCommitmentSecret, hash2.ToArray()); |
| | | 89 | | |
| | | 90 | | // Add the two terms |
| | 4 | 91 | | return AddPrivateKeys(term1, term2); |
| | | 92 | | } |
| | | 93 | | |
| | | 94 | | /// <summary> |
| | | 95 | | /// Generates per-commitment secret from seed and index |
| | | 96 | | /// </summary> |
| | | 97 | | public static byte[] GeneratePerCommitmentSecret(byte[] seed, ulong index) |
| | | 98 | | { |
| | 288 | 99 | | using var sha256 = new Sha256(); |
| | | 100 | | |
| | 288 | 101 | | var secret = new byte[seed.Length]; |
| | 288 | 102 | | Buffer.BlockCopy(seed, 0, secret, 0, seed.Length); |
| | | 103 | | |
| | 28224 | 104 | | for (var b = 47; b >= 0; b--) |
| | | 105 | | { |
| | 13824 | 106 | | if (((index >> b) & 1) == 0) |
| | | 107 | | { |
| | | 108 | | continue; |
| | | 109 | | } |
| | | 110 | | |
| | | 111 | | // Flip bit (b % 8) in byte (b / 8) |
| | 8760 | 112 | | secret[b / 8] ^= (byte)(1 << (b % 8)); |
| | 8760 | 113 | | sha256.AppendData(secret); |
| | 8760 | 114 | | sha256.GetHashAndReset(secret); |
| | | 115 | | } |
| | | 116 | | |
| | 288 | 117 | | return secret; |
| | 288 | 118 | | } |
| | | 119 | | |
| | | 120 | | /// <summary> |
| | | 121 | | /// Helper method to calculate SHA256(point1 || point2) |
| | | 122 | | /// </summary> |
| | | 123 | | private static void ComputeSha256(PubKey point1, PubKey point2, Span<byte> buffer) |
| | | 124 | | { |
| | 24 | 125 | | using var sha256 = new Sha256(); |
| | 24 | 126 | | sha256.AppendData(point1.ToBytes()); |
| | 24 | 127 | | sha256.AppendData(point2.ToBytes()); |
| | 24 | 128 | | sha256.GetHashAndReset(buffer); |
| | 48 | 129 | | } |
| | | 130 | | |
| | | 131 | | /// <summary> |
| | | 132 | | /// Adds two public keys (EC point addition) |
| | | 133 | | /// </summary> |
| | | 134 | | private static PubKey AddPubKeys(PubKey pubKey1, PubKey pubKey2) |
| | | 135 | | { |
| | | 136 | | // Create ECPubKey objects |
| | 8 | 137 | | if (!ECPubKey.TryCreate(pubKey1.ToBytes(), NLightningContext.Instance, out _, out var ecPubKey1)) |
| | 0 | 138 | | throw new ArgumentException("Invalid public key", nameof(pubKey1)); |
| | | 139 | | |
| | 8 | 140 | | if (!ECPubKey.TryCreate(pubKey2.ToBytes(), NLightningContext.Instance, out _, out var ecPubKey2)) |
| | 0 | 141 | | throw new ArgumentException("Invalid public key", nameof(pubKey2)); |
| | | 142 | | |
| | | 143 | | // Use TryCombine to add the pubkeys |
| | 8 | 144 | | if (!ECPubKey.TryCombine(NLightningContext.Instance, [ecPubKey1, ecPubKey2], out var combinedPubKey)) |
| | 0 | 145 | | throw new InvalidOperationException("Failed to combine public keys"); |
| | | 146 | | |
| | | 147 | | // Create a new PubKey from the combined ECPubKey |
| | 8 | 148 | | return new PubKey(combinedPubKey!.ToBytes()); |
| | | 149 | | } |
| | | 150 | | |
| | | 151 | | /// <summary> |
| | | 152 | | /// Multiplies a public key by a scalar |
| | | 153 | | /// </summary> |
| | | 154 | | private static PubKey MultiplyPubKey(PubKey pubKey, byte[] scalar) |
| | | 155 | | { |
| | 8 | 156 | | ArgumentNullException.ThrowIfNull(pubKey); |
| | 8 | 157 | | if (scalar is not { Length: 32 }) |
| | 0 | 158 | | throw new ArgumentException("Scalar must be 32 bytes", nameof(scalar)); |
| | | 159 | | |
| | | 160 | | // Convert PubKey to ECPubKey |
| | 8 | 161 | | if (!ECPubKey.TryCreate(pubKey.ToBytes(), NLightningContext.Instance, out var compressed, out var ecPubKey)) |
| | 0 | 162 | | throw new ArgumentException("Invalid public key", nameof(pubKey)); |
| | | 163 | | |
| | | 164 | | // Multiply using TweakMul |
| | 8 | 165 | | var multipliedPubKey = ecPubKey.TweakMul(scalar); |
| | | 166 | | |
| | | 167 | | // Create a new PubKey from the result |
| | 8 | 168 | | return new PubKey(multipliedPubKey.ToBytes(compressed)); |
| | | 169 | | } |
| | | 170 | | |
| | | 171 | | /// <summary> |
| | | 172 | | /// Adds two private keys (modular addition in the EC field) |
| | | 173 | | /// </summary> |
| | | 174 | | private Key AddPrivateKeys(Key key1, Key key2) |
| | | 175 | | { |
| | 8 | 176 | | ArgumentNullException.ThrowIfNull(key1); |
| | 8 | 177 | | ArgumentNullException.ThrowIfNull(key2); |
| | | 178 | | |
| | | 179 | | // Extract the bytes from the second key |
| | 8 | 180 | | var key2Bytes = key2.ToBytes(); |
| | | 181 | | |
| | | 182 | | // Create a temporary ECPrivKey from the first key's bytes |
| | 8 | 183 | | if (!NLightningContext.Instance.TryCreateECPrivKey(key1.ToBytes(), out var ecKey1)) |
| | 0 | 184 | | throw new InvalidOperationException("Invalid first private key"); |
| | | 185 | | |
| | | 186 | | // Add the second key to the first using TweakAdd |
| | 8 | 187 | | var resultKey = ecKey1.TweakAdd(key2Bytes); |
| | | 188 | | |
| | | 189 | | // Create a new Key with the result |
| | 8 | 190 | | return new Key(resultKey.sec.ToBytes()); |
| | | 191 | | } |
| | | 192 | | |
| | | 193 | | /// <summary> |
| | | 194 | | /// Multiplies a private key by a scalar |
| | | 195 | | /// </summary> |
| | | 196 | | private static Key MultiplyPrivateKey(Key key, byte[] scalar) |
| | | 197 | | { |
| | 8 | 198 | | ArgumentNullException.ThrowIfNull(key); |
| | 8 | 199 | | if (scalar is not { Length: 32 }) |
| | 0 | 200 | | throw new ArgumentException("Scalar must be 32 bytes", nameof(scalar)); |
| | | 201 | | |
| | | 202 | | // Create a temporary ECPrivKey from the key's bytes |
| | 8 | 203 | | if (!NLightningContext.Instance.TryCreateECPrivKey(key.ToBytes(), out var ecKey)) |
| | 0 | 204 | | throw new InvalidOperationException("Invalid private key"); |
| | | 205 | | |
| | | 206 | | // Multiply using TweakMul |
| | 8 | 207 | | var multipliedKey = ecKey.TweakMul(scalar); |
| | | 208 | | |
| | | 209 | | // Create a new Key with the result |
| | 8 | 210 | | return new Key(multipliedKey.sec.ToBytes()); |
| | | 211 | | } |
| | | 212 | | } |