@ -400,27 +400,27 @@ For each hop the sender (Alice) repeats the same process:
1. Alice generates the per-hop shared secret and the rho, mu, and pad keys
1. Alice generates 1300 bytes of filler and fills the 1300-byte onion payload field with this filler.
2. Alice generates 1300 bytes of filler and fills the 1300-byte onion payload field with this filler.
1. Alice calculates the HMAC for the hop payload (zeros for the final hop).
3. Alice calculates the HMAC for the hop payload (zeros for the final hop).
1. Alice calculates the length of the hop payload + HMAC + space to store the length itself
4. Alice calculates the length of the hop payload + HMAC + space to store the length itself
1. Alice _right shifts_ the onion payload by the calculated space needed to fit the hop payload. The rightmost "filler" data is discarded, making enough space on the left for the payload.
5. Alice _right shifts_ the onion payload by the calculated space needed to fit the hop payload. The rightmost "filler" data is discarded, making enough space on the left for the payload.
1. Alice inserts the length + hop payload + HMAC at the front of the payload field in the space made from shifting the filler.
6. Alice inserts the length + hop payload + HMAC at the front of the payload field in the space made from shifting the filler.
1. Alice uses the _rho_ key to generate a 1300 byte one-time-pad.
7. Alice uses the _rho_ key to generate a 1300 byte one-time-pad.
1. Alice obfuscates the entire onion payload by XOR-ing with the bytes generated from rho.
8. Alice obfuscates the entire onion payload by XOR-ing with the bytes generated from rho.
1. Alice calculates the HMAC of the onion payload, using the mu key.
9. Alice calculates the HMAC of the onion payload, using the mu key.
1. Alice adds the session public key (so that the hop can calculate the shared secret)
10. Alice adds the session public key (so that the hop can calculate the shared secret)
1. Alice adds the version number.
11. Alice adds the version number.
1. Deterministically re-blinds the session key using a value derived by hashing the shared secret and prior hop's public key.
12. Deterministically re-blinds the session key using a value derived by hashing the shared secret and prior hop's public key.
Next, Alice repeats the process. The new keys are calculated, the onion payload is shifted (dropping more junk), the new hop payload is added to the front and the whole onion payload encrypted with the rho byte-stream for the next hop.
@ -618,7 +618,7 @@ Bob will unwrap the onion he received from Alice as follows:
1. Bob takes the session key from the onion packet and derives the Alice-Bob shared secret.
1. Bob generates the +mu+ key from the shared secret and uses it to verify the onion packet HMAC checksum.
2. Bob generates the +mu+ key from the shared secret and uses it to verify the onion packet HMAC checksum.
Now that Bob has generated the shared key and verified the HMAC, he can start unwrapping the 1300 byte onion payload inside the onion packet. The goal is for Bob to retrieve his own hop payload and then forward the remaining onion to the next hop.
@ -724,27 +724,27 @@ Chan repeats the exact same process as Bob:
1. Chan receives the +update_add_htlc+ and processes the HTLC request, adding it to commitment transactions.
1. Chan generates the Alice-Chan shared key and the +mu+ subkey
2. Chan generates the Alice-Chan shared key and the +mu+ subkey
1. Chan verifies the onion packet HMAC, then extracts the 1300 onion payload
3. Chan verifies the onion packet HMAC, then extracts the 1300 onion payload
1. Chan extends the onion payload by 1300 extra bytes, filling it with zeroes.
4. Chan extends the onion payload by 1300 extra bytes, filling it with zeroes.
1. Chan uses the +rho+ key to produce 2600 bytes.
5. Chan uses the +rho+ key to produce 2600 bytes.
1. Chan uses the generated byte stream to XOR and de-obfuscate the onion payload. Simultaneously the XOR operation obfuscates the extra 1300 zeroes, turning them into filler
6. Chan uses the generated byte stream to XOR and de-obfuscate the onion payload. Simultaneously the XOR operation obfuscates the extra 1300 zeroes, turning them into filler
1. Chan extracts the inner HMAC in the payload, which will become the outer HAMC for Dina.
7. Chan extracts the inner HMAC in the payload, which will become the outer HAMC for Dina.
1. Chan removes his hop payload and left-shifts the onion payload by the same amount. Some of the filler generated in the 1300 extended bytes move into the first-half 1300 bytes becoming part of the onion payload.
8. Chan removes his hop payload and left-shifts the onion payload by the same amount. Some of the filler generated in the 1300 extended bytes move into the first-half 1300 bytes becoming part of the onion payload.
1. Chan constructs the onion packet for Dina with this onion payload.
9. Chan constructs the onion packet for Dina with this onion payload.
1. Chan builds an +update_add_htlc+ message for Dina and inserts the onion packet into it.
10. Chan builds an +update_add_htlc+ message for Dina and inserts the onion packet into it.
1. Chan sends the +update_add_htlc+ to Dina
11. Chan sends the +update_add_htlc+ to Dina
1. Chan re-randomizes the session key as Bob did in the prior hop for Dina.
12. Chan re-randomizes the session key as Bob did in the prior hop for Dina.
randymcmillan
3 years ago