Add an `ExpandedKey` key for phantom blinded path authentication
What the developer wrote
Authored by Matt Corallo
Add an `ExpandedKey` key for phantom blinded path authentication
In the coming commits we'll add support for building a blinded path
which can be received to any one of several nodes in a "phantom"
configuration (terminology we retain from BOLT 11 though there are
no longer any phantom nodes in the paths).
Here we adda new key in `ExpandedKey` which we can use to
authenticate blinded paths as coming from a phantom node
participant.
What changed, and why it matters
This commit adds a seventh cryptographic key to an existing key-expansion routine. The new key is intended for a future feature where multiple nodes can share a 'phantom' blinded payment path. The change itself only extends the HKDF output and stores the extra key; it does not introduce a vulnerability or fix one.
No immediate action required. Treat as a normal feature-prep commit. Review the follow-up commits that actually consume `phantom_node_blinded_path_key` for authentication logic and key handling.
Security signals we found
Cryptographic key material expansion changed (HKDF output count increased from 6 to 7)
New secret key field added to `ExpandedKey` struct
No security relevance disclosed by the vendor in commit message or diff
Evidence from the diff
The patch extends the hkdf_extract_expand! macro and the hkdf_extract_expand_6x/7x helper from six to seven 32-byte outputs. It adds a new field phantom_node_blinded_path_key to ExpandedKey, populated from the same HKDF expansion with the same salt and key material. No existing key usage is altered, and no authentication/verification logic is implemented yet. This is preparatory refactoring for an upcoming phantom-node blinded-path feature.
Changed components
lightning/src/crypto/utils.rslightning/src/ln/inbound_payment.rsInspect captured patch +18 / −7
diff --git a/lightning/src/crypto/utils.rs b/lightning/src/crypto/utils.rs
index 1570b3a..88911b0 100644
--- a/lightning/src/crypto/utils.rs
+++ b/lightning/src/crypto/utils.rs
@@ -22,7 +22,7 @@ macro_rules! hkdf_extract_expand {
let (k1, k2, _) = hkdf_extract_expand!($salt, $ikm);
(k1, k2)
}};
- ($salt: expr, $ikm: expr, 6) => {{
+ ($salt: expr, $ikm: expr, 7) => {{
let (k1, k2, prk) = hkdf_extract_expand!($salt, $ikm);
let mut hmac = HmacEngine::<Sha256>::new(&prk[..]);
@@ -45,7 +45,12 @@ macro_rules! hkdf_extract_expand {
hmac.input(&[6; 1]);
let k6 = Hmac::from_engine(hmac).to_byte_array();
- (k1, k2, k3, k4, k5, k6)
+ let mut hmac = HmacEngine::<Sha256>::new(&prk[..]);
+ hmac.input(&k6);
+ hmac.input(&[7; 1]);
+ let k7 = Hmac::from_engine(hmac).to_byte_array();
+
+ (k1, k2, k3, k4, k5, k6, k7)
}};
}
@@ -53,10 +58,10 @@ pub fn hkdf_extract_expand_twice(salt: &[u8], ikm: &[u8]) -> ([u8; 32], [u8; 32]
hkdf_extract_expand!(salt, ikm, 2)
}
-pub fn hkdf_extract_expand_6x(
+pub fn hkdf_extract_expand_7x(
salt: &[u8], ikm: &[u8],
-) -> ([u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32]) {
- hkdf_extract_expand!(salt, ikm, 6)
+) -> ([u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32]) {
+ hkdf_extract_expand!(salt, ikm, 7)
}
#[inline]
diff --git a/lightning/src/ln/inbound_payment.rs b/lightning/src/ln/inbound_payment.rs
index 51f8b7b..d70a20e 100644
--- a/lightning/src/ln/inbound_payment.rs
+++ b/lightning/src/ln/inbound_payment.rs
@@ -15,7 +15,7 @@ use bitcoin::hashes::sha256::Hash as Sha256;
use bitcoin::hashes::{Hash, HashEngine};
use crate::crypto::chacha20::ChaCha20;
-use crate::crypto::utils::hkdf_extract_expand_6x;
+use crate::crypto::utils::hkdf_extract_expand_7x;
use crate::ln::msgs;
use crate::ln::msgs::MAX_VALUE_MSAT;
use crate::offers::nonce::Nonce;
@@ -56,6 +56,10 @@ pub struct ExpandedKey {
/// The key used to authenticate spontaneous payments' metadata as previously registered with LDK
/// for inclusion in a blinded path.
spontaneous_pmt_key: [u8; 32],
+ /// The key used to authenticate phantom-node-shared blinded paths as generated by us. Note
+ /// that this is not used for blinded paths that are not expected to be shared across nodes
+ /// participating in a "phantom node".
+ pub(crate) phantom_node_blinded_path_key: [u8; 32],
}
impl ExpandedKey {
@@ -70,7 +74,8 @@ impl ExpandedKey {
offers_base_key,
offers_encryption_key,
spontaneous_pmt_key,
- ) = hkdf_extract_expand_6x(b"LDK Inbound Payment Key Expansion", &key_material);
+ phantom_node_blinded_path_key,
+ ) = hkdf_extract_expand_7x(b"LDK Inbound Payment Key Expansion", &key_material);
Self {
metadata_key,
ldk_pmt_hash_key,
@@ -78,6 +83,7 @@ impl ExpandedKey {
offers_base_key,
offers_encryption_key,
spontaneous_pmt_key,
+ phantom_node_blinded_path_key,
}
}
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.