cln+lnd: implement signer interface

Author: guggero

cln/signer.go

@@ -0,0 +1,128 @@
+package cln
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/btcsuite/btcd/btcec/v2"
+	"github.com/btcsuite/btcd/btcutil/psbt"
+	"github.com/btcsuite/btcd/txscript"
+	"github.com/btcsuite/btcd/wire"
+	"github.com/btcsuite/btcwallet/wallet"
+	"github.com/lightninglabs/chantools/lnd"
+	"github.com/lightningnetwork/lnd/input"
+	"github.com/lightningnetwork/lnd/keychain"
+)
+
+type Signer struct {
+	HsmSecret [32]byte
+}
+
+func (s *Signer) SignOutputRaw(tx *wire.MsgTx,
+	signDesc *input.SignDescriptor) (input.Signature, error) {
+
+	// First attempt to fetch the private key which corresponds to the
+	// specified public key.
+	privKey, err := s.FetchPrivateKey(&signDesc.KeyDesc)
+	if err != nil {
+		return nil, err
+	}
+
+	return lnd.SignOutputRawWithPrivateKey(tx, signDesc, privKey)
+}
+
+func (s *Signer) FetchPrivateKey(
+	descriptor *keychain.KeyDescriptor) (*btcec.PrivateKey, error) {
+
+	_, privKey, err := DeriveKeyPair(s.HsmSecret, descriptor)
+	return privKey, err
+}
+
+func (s *Signer) FindMultisigKey(targetPubkey, peerPubKey *btcec.PublicKey,
+	maxNumKeys uint32) (*keychain.KeyDescriptor, error) {
+
+	// Loop through the local multisig keys to find the target key.
+	for index := range maxNumKeys {
+		privKey, err := s.FetchPrivateKey(&keychain.KeyDescriptor{
+			PubKey: peerPubKey,
+			KeyLocator: keychain.KeyLocator{
+				Family: keychain.KeyFamilyMultiSig,
+				Index:  index,
+			},
+		})
+		if err != nil {
+			return nil, fmt.Errorf("error deriving funding "+
+				"private key: %w", err)
+		}
+
+		currentPubkey := privKey.PubKey()
+		if !targetPubkey.IsEqual(currentPubkey) {
+			continue
+		}
+
+		return &keychain.KeyDescriptor{
+			PubKey: peerPubKey,
+			KeyLocator: keychain.KeyLocator{
+				Family: keychain.KeyFamilyMultiSig,
+				Index:  index,
+			},
+		}, nil
+	}
+
+	return nil, errors.New("no matching pubkeys found")
+}
+
+func (s *Signer) AddPartialSignature(packet *psbt.Packet,
+	keyDesc keychain.KeyDescriptor, utxo *wire.TxOut, witnessScript []byte,
+	inputIndex int) error {
+
+	// Now we add our partial signature.
+	prevOutFetcher := wallet.PsbtPrevOutputFetcher(packet)
+	signDesc := &input.SignDescriptor{
+		KeyDesc:           keyDesc,
+		WitnessScript:     witnessScript,
+		Output:            utxo,
+		InputIndex:        inputIndex,
+		HashType:          txscript.SigHashAll,
+		PrevOutputFetcher: prevOutFetcher,
+		SigHashes: txscript.NewTxSigHashes(
+			packet.UnsignedTx, prevOutFetcher,
+		),
+	}
+	ourSigRaw, err := s.SignOutputRaw(packet.UnsignedTx, signDesc)
+	if err != nil {
+		return fmt.Errorf("error signing with our key: %w", err)
+	}
+	ourSig := append(ourSigRaw.Serialize(), byte(txscript.SigHashAll))
+
+	// Because of the way we derive keys in CLN, the public key in the key
+	// descriptor is the peer's public key, not our own. So we need to
+	// derive our own public key from the private key.
+	ourPrivKey, err := s.FetchPrivateKey(&keyDesc)
+	if err != nil {
+		return fmt.Errorf("error fetching private key for descriptor "+
+			"%v: %w", keyDesc, err)
+	}
+	ourPubKey := ourPrivKey.PubKey()
+
+	// Great, we were able to create our sig, let's add it to the PSBT.
+	updater, err := psbt.NewUpdater(packet)
+	if err != nil {
+		return fmt.Errorf("error creating PSBT updater: %w", err)
+	}
+	status, err := updater.Sign(
+		inputIndex, ourSig, ourPubKey.SerializeCompressed(), nil,
+		witnessScript,
+	)
+	if err != nil {
+		return fmt.Errorf("error adding signature to PSBT: %w", err)
+	}
+	if status != 0 {
+		return fmt.Errorf("unexpected status for signature update, "+
+			"got %d wanted 0", status)
+	}
+
+	return nil
+}
+
+var _ lnd.ChannelSigner = (*Signer)(nil)

lnd/signer.go

@@ -20,6 +20,21 @@ import (
 	"github.com/lightningnetwork/lnd/keychain"
 )
 
+type ChannelSigner interface {
+	SignOutputRaw(tx *wire.MsgTx,
+		signDesc *input.SignDescriptor) (input.Signature, error)
+
+	FetchPrivateKey(descriptor *keychain.KeyDescriptor) (
+		*btcec.PrivateKey, error)
+
+	FindMultisigKey(targetPubkey, peerPubKey *btcec.PublicKey,
+		maxNumKeys uint32) (*keychain.KeyDescriptor, error)
+
+	AddPartialSignature(packet *psbt.Packet,
+		keyDesc keychain.KeyDescriptor, utxo *wire.TxOut,
+		witnessScript []byte, inputIndex int) error
+}
+
 type Signer struct {
 	*input.MusigSessionManager
 
@@ -37,10 +52,10 @@ func (s *Signer) SignOutputRaw(tx *wire.MsgTx,
 		return nil, err
 	}
 
-	return s.SignOutputRawWithPrivateKey(tx, signDesc, privKey)
+	return SignOutputRawWithPrivateKey(tx, signDesc, privKey)
 }
 
-func (s *Signer) SignOutputRawWithPrivateKey(tx *wire.MsgTx,
+func SignOutputRawWithPrivateKey(tx *wire.MsgTx,
 	signDesc *input.SignDescriptor,
 	privKey *secp256k1.PrivateKey) (input.Signature, error) {
 
@@ -140,6 +155,51 @@ func (s *Signer) FetchPrivateKey(descriptor *keychain.KeyDescriptor) (
 	return key.ECPrivKey()
 }
 
+func (s *Signer) FindMultisigKey(targetPubkey, _ *btcec.PublicKey,
+	maxNumKeys uint32) (*keychain.KeyDescriptor, error) {
+
+	// First, we need to derive the correct branch from the local root key.
+	multisigBranch, err := DeriveChildren(s.ExtendedKey, []uint32{
+		HardenedKeyStart + uint32(keychain.BIP0043Purpose),
+		HardenedKeyStart + s.ChainParams.HDCoinType,
+		HardenedKeyStart + uint32(keychain.KeyFamilyMultiSig),
+		0,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("could not derive local multisig key: "+
+			"%w", err)
+	}
+
+	// Loop through the local multisig keys to find the target key.
+	for index := range maxNumKeys {
+		currentKey, err := multisigBranch.DeriveNonStandard(index)
+		if err != nil {
+			return nil, fmt.Errorf("error deriving child key: %w",
+				err)
+		}
+
+		currentPubkey, err := currentKey.ECPubKey()
+		if err != nil {
+			return nil, fmt.Errorf("error deriving public key: %w",
+				err)
+		}
+
+		if !targetPubkey.IsEqual(currentPubkey) {
+			continue
+		}
+
+		return &keychain.KeyDescriptor{
+			PubKey: currentPubkey,
+			KeyLocator: keychain.KeyLocator{
+				Family: keychain.KeyFamilyMultiSig,
+				Index:  index,
+			},
+		}, nil
+	}
+
+	return nil, errors.New("no matching pubkeys found")
+}
+
 func (s *Signer) AddPartialSignature(packet *psbt.Packet,
 	keyDesc keychain.KeyDescriptor, utxo *wire.TxOut, witnessScript []byte,
 	inputIndex int) error {
@@ -199,7 +259,7 @@ func (s *Signer) AddPartialSignatureForPrivateKey(packet *psbt.Packet,
 			packet.UnsignedTx, prevOutFetcher,
 		),
 	}
-	ourSigRaw, err := s.SignOutputRawWithPrivateKey(
+	ourSigRaw, err := SignOutputRawWithPrivateKey(
 		packet.UnsignedTx, signDesc, privateKey,
 	)
 	if err != nil {
@@ -258,7 +318,7 @@ func (s *Signer) AddTaprootSignature(packet *psbt.Packet, inputIndex int,
 		signDesc.TapTweak = pIn.TaprootMerkleRoot
 	}
 
-	ourSigRaw, err := s.SignOutputRawWithPrivateKey(
+	ourSigRaw, err := SignOutputRawWithPrivateKey(
 		packet.UnsignedTx, signDesc, privateKey,
 	)
 	if err != nil {