Implement latest changes

The `proof_signature` now signs a merkle tree that contains all TLVs of
the payer proof, similar to how `offer`, `invoice_request` and `invoice`
are signed.

Author: t-bast

eclair-core/src/main/scala/fr/acinq/eclair/payment/offer/PayerProof.scala

@@ -41,6 +41,15 @@ case class PayerProof(records: TlvStream[PayerProofTlv]) {
     PayerProof.validate(records) match {
       case Left(_) => false
       case Right(_) =>
+        // The proof signature must be valid: it signs all TLVs (except itself) using the invreq_payer_id,
+        // with an empty invreq_metadata field (to prevent brute-forcing omitted fields).
+        val payerSig = records.get[ProofSignature].get.signature
+        val payerId = records.get[InvoiceRequestPayerId].get.publicKey
+        val proofRootHash = rootHash(TlvStream(records.records.filterNot(_.isInstanceOf[ProofSignature]), records.unknown), OfferCodecs.payerProofCodec)
+        if (!verifySchnorr(PayerProof.signatureTag, proofRootHash, payerSig, payerId)) {
+          return false
+        }
+        // The proof must contain enough data to reconstruct the invoice merkle root.
         val leafNonces = records.get[LeafHashes].map(_.hashes).getOrElse(Nil)
         val markers = records.get[OmittedTlvs].map(_.missing).getOrElse(Nil)
         val missingHashes = records.get[MissingHashes].map(_.missing).getOrElse(Nil)
@@ -66,7 +75,10 @@ case class PayerProof(records: TlvStream[PayerProofTlv]) {
         val omittedLeavesOk = allLeavesExceptMetadata.zipWithIndex.forall {
           case ((_, Some(_)), _) => true
           case ((marker, None), idx) if idx == 0 => marker == UInt64(1)
-          case ((marker, None), idx) => marker == (allLeavesExceptMetadata(idx - 1)._1 + 1)
+          case ((marker, None), idx) =>
+            val previous = allLeavesExceptMetadata(idx - 1)._1
+            val expected = if (previous == UInt64(239)) UInt64(1_000_000_000) else previous + 1
+            marker == expected
         }
         if (!omittedLeavesOk) {
           return false
@@ -75,22 +87,11 @@ case class PayerProof(records: TlvStream[PayerProofTlv]) {
         val allLeaves = (Option.empty[LeafWithNonce] +: allLeavesExceptMetadata.map(_._2)).toIndexedSeq
         PayerProofTree.merkleRoot(allLeaves, missingHashes) match {
           case Left(_) => false
-          case Right(rootHash) =>
+          case Right(invoiceRootHash) =>
+            // The invoice signature must be valid against invoice_node_id over the reconstructed merkle root.
             val invoiceSig = records.get[Signature].get.signature
             val invoiceNodeId = records.get[InvoiceNodeId].get.nodeId
-            if (!verifySchnorr(Bolt12Invoice.signatureTag, rootHash, invoiceSig, invoiceNodeId)) {
-              // The invoice signature must be valid against invoice_node_id over the reconstructed merkle root.
-              false
-            } else {
-              // The payer signature must be valid against invreq_payer_id over SHA256(note || merkle_root).
-              val payerSig = records.get[PayerSignature].get.signature
-              val payerId = records.get[InvoiceRequestPayerId].get.publicKey
-              val msg = records.get[PayerSignature].flatMap(_.note_opt) match {
-                case Some(note) => Crypto.sha256(ByteVector(note.getBytes) ++ rootHash)
-                case None => Crypto.sha256(rootHash)
-              }
-              verifySchnorr(PayerProof.signatureTag, msg, payerSig, payerId)
-            }
+            verifySchnorr(Bolt12Invoice.signatureTag, invoiceRootHash, invoiceSig, invoiceNodeId)
         }
     }
   }
@@ -105,7 +106,7 @@ case class PayerProof(records: TlvStream[PayerProofTlv]) {
 object PayerProof {
 
   val hrp = "lnp"
-  val signatureTag: ByteVector = ByteVector(("lightning" + "payer_proof" + "payer_signature").getBytes)
+  val signatureTag: ByteVector = ByteVector(("lightning" + "payer_proof" + "proof_signature").getBytes)
 
   /** Specifies which optional fields from the invoice should be included in the payer proof. */
   case class IncludedFields(offerChains: Boolean = false,
@@ -134,6 +135,8 @@ object PayerProof {
                             unknown: Set[UInt64] = Set.empty)
 
   def create(invoice: Bolt12Invoice, preimage: ByteVector32, payerKey: PrivateKey, fields: IncludedFields, note_opt: Option[String]): PayerProof = {
+    // Valid Bolt12 invoices always contain the invreq_metadata field: it is used as a hashing nonce to prevent brute-forcing private fields.
+    val invreqMetadata = invoice.records.get[InvoiceRequestMetadata].get
     // We select invoice fields that we want to include in our payer proof.
     val knownLeaves: Set[(InvoiceTlv, Boolean)] = invoice.records.records
       .filterNot(_.isInstanceOf[Signature])
@@ -179,8 +182,6 @@ object PayerProof {
       .toSeq
       .sortBy(_._1.tag)
       .map { case (tlv, included) => PayerProofTree.Leaf(tlv, included) }
-    // The invreq_metadata field must be provided (required in Bolt12Invoice).
-    val invreqMetadata = invoice.records.get[InvoiceRequestMetadata].get
     // We include the leaf nonce for each invoice TLV we include in the payer proof.
     val leafNonces = leaves.collect {
       case leaf if leaf.included => PayerProofTree.leafNonce(invreqMetadata, leaf.tlv)
@@ -197,26 +198,29 @@ object PayerProof {
         // This TLV is not included in the payer proof: we add an entry with a marker.
         val markerNumber = previousTlv_opt match {
           case Some(tag) => tag + 1
-          case None => omitted.lastOption.map(tag => tag + 1).getOrElse(UInt64(1))
+          case None => omitted.lastOption match {
+            case Some(tag) if tag == UInt64(239) => UInt64(1_000_000_000)
+            case Some(tag) => tag + 1
+            case None => UInt64(1)
+          }
         }
         (omitted :+ markerNumber, None)
     }._1.toList
     val proofTree = PayerProofTree(leaves)
     val missingHashes = PayerProofTree.computeMissingHashes(proofTree, invreqMetadata)
-    val payerSig = note_opt match {
-      case Some(note) => signSchnorr(signatureTag, Crypto.sha256(ByteVector(note.getBytes) ++ proofTree.hash(invreqMetadata)), payerKey)
-      case None => signSchnorr(signatureTag, Crypto.sha256(proofTree.hash(invreqMetadata)), payerKey)
-    }
     val includedInvoiceTlvs = knownLeaves.collect { case (tlv, true) => tlv }.toSet[PayerProofTlv]
     val payerProofTlvs = Set(
       Some(InvoicePreimage(preimage)),
       Some(LeafHashes(leafNonces)),
       if (omittedTlvs.nonEmpty) Some(OmittedTlvs(omittedTlvs)) else None,
       if (missingHashes.nonEmpty) Some(MissingHashes(missingHashes)) else None,
-      Some(PayerSignature(payerSig, note_opt))
+      note_opt.map(note => ProofNote(note)),
     ).flatten[PayerProofTlv]
     val includedUnknownTlvs = unknownLeaves.collect { case (tlv, true) => tlv }
-    PayerProof(TlvStream(includedInvoiceTlvs ++ invoice.records.get[Signature].toSet ++ payerProofTlvs, includedUnknownTlvs))
+    val tlvsWithoutProofSig = TlvStream(includedInvoiceTlvs ++ invoice.records.get[Signature].toSet ++ payerProofTlvs, includedUnknownTlvs)
+    // We use a static 0x0000 hashing nonce instead of the invreq_metadata, which we don't want to disclose.
+    val proofSig = signSchnorr(signatureTag, rootHash(tlvsWithoutProofSig, OfferCodecs.payerProofCodec), payerKey)
+    PayerProof(tlvsWithoutProofSig.copy(records = tlvsWithoutProofSig.records + ProofSignature(proofSig)))
   }
 
   /** When validating a proof, the leaf nonce is directly provided to avoid brute-forcing omitted fields. */
@@ -354,15 +358,14 @@ object PayerProof {
     if (records.get[InvoicePaymentHash].isEmpty) return Left(MissingRequiredTlv(UInt64(168)))
     if (records.get[InvoiceNodeId].isEmpty) return Left(MissingRequiredTlv(UInt64(176)))
     if (records.get[Signature].isEmpty) return Left(MissingRequiredTlv(UInt64(240)))
-    if (records.get[InvoicePreimage].isEmpty) return Left(MissingRequiredTlv(UInt64(242)))
-    if (records.get[PayerSignature].isEmpty) return Left(MissingRequiredTlv(UInt64(250)))
+    if (records.get[ProofSignature].isEmpty) return Left(MissingRequiredTlv(UInt64(241)))
+    if (records.get[InvoicePreimage].isEmpty) return Left(MissingRequiredTlv(UInt64(1001)))
     // The preimage must match the invoice's payment_hash.
-    if (Crypto.sha256(records.get[InvoicePreimage].get.preimage) != records.get[InvoicePaymentHash].get.hash) return Left(InvalidTlvValue(UInt64(242)))
+    if (Crypto.sha256(records.get[InvoicePreimage].get.preimage) != records.get[InvoicePaymentHash].get.hash) return Left(InvalidTlvValue(UInt64(1001)))
     val omittedTlvs = records.get[OmittedTlvs].map(_.missing).getOrElse(Nil)
-    if (omittedTlvs.length != omittedTlvs.distinct.length) return Left(InvalidTlvValue(UInt64(244)))
-    if (omittedTlvs.sorted != omittedTlvs) return Left(InvalidTlvValue(UInt64(244)))
-    if (omittedTlvs.contains(UInt64(0))) return Left(InvalidTlvValue(UInt64(244)))
-    if (omittedTlvs.exists(tag => tag >= UInt64(240) && tag <= UInt64(1000))) return Left(InvalidTlvValue(UInt64(244)))
+    if (omittedTlvs.length != omittedTlvs.distinct.length) return Left(InvalidTlvValue(UInt64(1002)))
+    if (omittedTlvs.sorted != omittedTlvs) return Left(InvalidTlvValue(UInt64(1002)))
+    if (!omittedTlvs.forall(tag => (tag >= UInt64(1) && tag <= UInt64(239)) || (tag >= UInt64(1_000_000_000L) && tag <= UInt64(3_999_999_999L)))) return Left(InvalidTlvValue(UInt64(1002)))
     Right(PayerProof(records))
   }
 

eclair-core/src/main/scala/fr/acinq/eclair/wire/protocol/OfferCodecs.scala

@@ -201,11 +201,12 @@ object OfferCodecs {
     .typecase(UInt64(240), signature)
   ).complete)
 
+  private val proofSig: Codec[ProofSignature] = tlvField(bytes64)
   private val preimage: Codec[InvoicePreimage] = tlvField(bytes32)
   private val omitted: Codec[OmittedTlvs] = tlvField(list(varint))
   private val missingHashes: Codec[MissingHashes] = tlvField(list(bytes32))
   private val leafHashes: Codec[LeafHashes] = tlvField(list(bytes32))
-  private val payerSig: Codec[PayerSignature] = tlvField(bytes64 :: optional(bitsRemaining, utf8))
+  private val proofNote: Codec[ProofNote] = tlvField(utf8)
 
   val payerProofTlvCodec: DiscriminatorCodec[PayerProofTlv, UInt64] = discriminated[PayerProofTlv].by(varint)
     // Invoice part that must be copy-pasted from above
@@ -239,11 +240,12 @@ object OfferCodecs {
     .typecase(UInt64(176), invoiceNodeId)
     .typecase(UInt64(240), signature)
     // Payer proof part
-    .typecase(UInt64(242), preimage)
-    .typecase(UInt64(244), omitted)
-    .typecase(UInt64(246), missingHashes)
-    .typecase(UInt64(248), leafHashes)
-    .typecase(UInt64(250), payerSig)
+    .typecase(UInt64(241), proofSig)
+    .typecase(UInt64(1001), preimage)
+    .typecase(UInt64(1002), omitted)
+    .typecase(UInt64(1003), missingHashes)
+    .typecase(UInt64(1004), leafHashes)
+    .typecase(UInt64(1005), proofNote)
 
   val payerProofCodec: Codec[TlvStream[PayerProofTlv]] = catchAllCodec(TlvCodecs.tlvStream[PayerProofTlv](payerProofTlvCodec).complete)
 

eclair-core/src/main/scala/fr/acinq/eclair/wire/protocol/OfferTypes.scala

@@ -224,6 +224,9 @@ object OfferTypes {
    */
   case class Signature(signature: ByteVector64) extends InvoiceRequestTlv with InvoiceTlv with PayerProofTlv
 
+  /** The payer signs the payer proof. */
+  case class ProofSignature(signature: ByteVector64) extends PayerProofTlv
+
   /** Preimage matching the invoice's [[InvoicePaymentHash]]. */
   case class InvoicePreimage(preimage: ByteVector32) extends PayerProofTlv
 
@@ -236,8 +239,8 @@ object OfferTypes {
   /** The payer must include a nonce hash for each invoice TLV included in the payer proof. */
   case class LeafHashes(hashes: List[ByteVector32]) extends PayerProofTlv
 
-  /** The payer signs the payer proof, with an optional challenge (note). */
-  case class PayerSignature(signature: ByteVector64, note_opt: Option[String]) extends PayerProofTlv
+  /** An optional challenge may be included in the payer proof. */
+  case class ProofNote(note: String) extends PayerProofTlv
 
   private def isOfferTlv(tlv: GenericTlv): Boolean =
     // Offer TLVs are in the range [1, 79] or [1000000000, 1999999999].
@@ -484,9 +487,12 @@ object OfferTypes {
     // Encoding tlvs is always safe, unless we have a bug in our codecs, so we can call `.require` here.
     val encoded = codec.encode(tlvs).require
     // Decoding tlvs that we just encoded is safe as well.
-    // This encoding/decoding step ensures that the resulting tlvs are ordered.
+    // This encoding/decoding step ensures that the resulting tlvs are ordered and that we combine known and unknown TLVs.
     val genericTlvs = vector(genericTlv).decode(encoded).require.value
-    val firstTlv = genericTlvs.minBy(_.tag)
+    // The invreq_metadata, which is always the first TLV when provided (tag=0), is used as a hashing nonce for all
+    // leaves of the tree to ensure that their values cannot be brute-forced when omitted in payer proofs.
+    // If invreq_metadata isn't provided (e.g. for payer proofs) an empty 0x0000 must be used instead.
+    val firstTlv = genericTlvs.find(_.tag == UInt64(0)).getOrElse(GenericTlv(UInt64(0), ByteVector.empty))
     val nonceKey = ByteVector("LnNonce".getBytes) ++ genericTlv.encode(firstTlv).require.bytes
 
     def previousPowerOfTwo(n: Int): Int = {