Remove get_node_secret from NodeSigner #1951

wpaulino · 2023-01-14T00:52:45Z

Secrets should not be exposed in-memory at the interface level as it would be impossible the implement it against a hardware security module/secure element.

Fixes #1819.

codecov-commenter · 2023-01-14T01:18:01Z

Codecov Report

Base: 90.73% // Head: 90.68% // Decreases project coverage by -0.05% ⚠️

Coverage data is based on head (8887b51) compared to base (98417a1).
Patch coverage: 80.54% of modified lines in pull request are covered.

❗ Current head 8887b51 differs from pull request most recent head acd2ae6. Consider uploading reports for the commit acd2ae6 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1951      +/-   ##
==========================================
- Coverage   90.73%   90.68%   -0.05%     
==========================================
  Files          97       97              
  Lines       50588    50660      +72     
  Branches    50588    50660      +72     
==========================================
+ Hits        45900    45941      +41     
- Misses       4688     4719      +31

Impacted Files	Coverage Δ
lightning/src/chain/channelmonitor.rs	`90.97% <ø> (-0.06%)`	⬇️
lightning/src/ln/onion_route_tests.rs	`97.63% <ø> (ø)`
lightning/src/chain/keysinterface.rs	`83.46% <50.00%> (-0.36%)`	⬇️
lightning/src/util/test_utils.rs	`72.04% <63.33%> (+0.74%)`	⬆️
lightning-net-tokio/src/lib.rs	`76.83% <71.87%> (-0.94%)`	⬇️
lightning/src/ln/msgs.rs	`86.01% <83.33%> (-0.02%)`	⬇️
lightning/src/ln/peer_channel_encryptor.rs	`91.94% <85.71%> (-1.44%)`	⬇️
lightning/src/ln/channel.rs	`89.02% <95.23%> (+0.25%)`	⬆️
lightning-background-processor/src/lib.rs	`95.46% <100.00%> (ø)`
lightning/src/ln/channelmanager.rs	`87.10% <100.00%> (-0.04%)`	⬇️
... and 14 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

lightning/src/ln/channel.rs

arik-so

I'm super excited about this PR. It's very obvious how much sweat has gone into this, so I hope we can land this soon without needing a bunch of rebases on the way.

lightning/src/ln/channel.rs

lightning-net-tokio/src/lib.rs

TheBlueMatt

Basically LGTM, needs rebase after #1946.

lightning/src/chain/keysinterface.rs

lightning/src/ln/channelmanager.rs

TheBlueMatt · 2023-01-15T05:02:57Z

I'd strongly prefer PRs this big be split into a few commits, this adds new signing methods that could be their own commit, refactors fuzzers that could, etc.

arik-so · 2023-01-18T17:24:25Z

LGTM, barring the newly arisen merge conflict.

TheBlueMatt · 2023-01-18T20:20:23Z

It should be super trivial to split this commit into, at least (a) the addition/use of sign_gossip_message, (b) the use of ecdh in a few more places, (c) the removal of get_node_secret.

fuzz/src/chanmon_consistency.rs

arik-so · 2023-01-18T23:52:06Z

fuzz/src/full_stack.rs

 	Arc<chainmonitor::ChainMonitor<EnforcingSigner, Arc<dyn chain::Filter>, Arc<TestBroadcaster>, Arc<FuzzEstimator>, Arc<dyn Logger>, Arc<TestPersister>>>,
 	Arc<TestBroadcaster>, Arc<KeyProvider>, Arc<KeyProvider>, Arc<KeyProvider>, Arc<FuzzEstimator>, &'a FuzzRouter, Arc<dyn Logger>>;
-type PeerMan<'a> = PeerManager<Peer<'a>, Arc<ChannelMan<'a>>, Arc<P2PGossipSync<Arc<NetworkGraph<Arc<dyn Logger>>>, Arc<dyn chain::Access>, Arc<dyn Logger>>>, IgnoringMessageHandler, Arc<dyn Logger>, IgnoringMessageHandler>;
+type PeerMan<'a> = PeerManager<Peer<'a>, Arc<ChannelMan<'a>>, Arc<P2PGossipSync<Arc<NetworkGraph<Arc<dyn Logger>>>, Arc<dyn chain::Access>, Arc<dyn Logger>>>, IgnoringMessageHandler, Arc<dyn Logger>, IgnoringMessageHandler, Arc<KeyProvider>>;


this technically has nothing to do with this PR and I know that this is just a fuzz test, but PeerMan and ChannelMan are horrible type names. At some point we should rename them to something more meaningful.

It's just a peer, man.

PeerWoman is underrepresented.

lightning/src/chain/keysinterface.rs

fuzz/src/utils/test_node_signer.rs

lightning/src/chain/keysinterface.rs

lightning/src/util/test_utils.rs

This ensures that we hit additional assertions which are intended to always be run in tests.

These implementations have every method panic, so assuming that the test suite passes, these implementations are never used.

Adds signing capability to NodeSigner for all gossip messages that require a node signature.

Secrets should not be exposed in-memory at the interface level as it would be impossible the implement it against a hardware security module/secure element.

arik-so reviewed Jan 14, 2023

View reviewed changes

lightning/src/ln/channel.rs Outdated Show resolved Hide resolved

arik-so reviewed Jan 14, 2023

View reviewed changes

lightning/src/ln/channel.rs Outdated Show resolved Hide resolved

arik-so reviewed Jan 14, 2023

View reviewed changes

lightning/src/ln/channel.rs Outdated Show resolved Hide resolved

arik-so requested changes Jan 14, 2023

View reviewed changes

TheBlueMatt assigned TheBlueMatt and arik-so Jan 14, 2023

wpaulino force-pushed the remove-get-node-secret branch from 6111eb7 to a74da34 Compare January 14, 2023 21:57

wpaulino mentioned this pull request Jan 14, 2023

WIP: eliminate leak of node secret key from KeysInterface #1362

Closed

TheBlueMatt reviewed Jan 15, 2023

View reviewed changes

lightning/src/chain/keysinterface.rs Outdated Show resolved Hide resolved

lightning/src/ln/channelmanager.rs Outdated Show resolved Hide resolved

lightning/src/ln/channelmanager.rs Outdated Show resolved Hide resolved

wpaulino force-pushed the remove-get-node-secret branch 2 times, most recently from 6069c13 to d2f885e Compare January 18, 2023 00:22

arik-so mentioned this pull request Jan 18, 2023

Split out EcdsaChannelSigner method from BaseSign, and rename it to ChannelSigner #1967

Merged

wpaulino force-pushed the remove-get-node-secret branch from d2f885e to 02f1674 Compare January 18, 2023 19:25

wpaulino force-pushed the remove-get-node-secret branch from 02f1674 to 8887b51 Compare January 18, 2023 22:27

arik-so reviewed Jan 18, 2023

View reviewed changes

fuzz/src/chanmon_consistency.rs Show resolved Hide resolved

arik-so reviewed Jan 18, 2023

View reviewed changes

lightning/src/chain/keysinterface.rs Show resolved Hide resolved

wpaulino force-pushed the remove-get-node-secret branch 2 times, most recently from da154e7 to e253c04 Compare January 19, 2023 00:00

arik-so reviewed Jan 19, 2023

View reviewed changes

fuzz/src/utils/test_node_signer.rs Outdated Show resolved Hide resolved

TheBlueMatt reviewed Jan 19, 2023

View reviewed changes

lightning/src/chain/keysinterface.rs Outdated Show resolved Hide resolved

lightning/src/util/test_utils.rs Outdated Show resolved Hide resolved

TheBlueMatt and others added 2 commits January 18, 2023 16:57

Always set _test_utils when building lightning for some tests

f3a6ca4

This ensures that we hit additional assertions which are intended to always be run in tests.

Remove unused NodeSigner implementations in tests

aee9952

These implementations have every method panic, so assuming that the test suite passes, these implementations are never used.

wpaulino force-pushed the remove-get-node-secret branch from e253c04 to 7fcbdf1 Compare January 19, 2023 00:58

wpaulino added 2 commits January 18, 2023 17:23

Add NodeSigner::sign_gossip_message

db0d6ec

Adds signing capability to NodeSigner for all gossip messages that require a node signature.

Sign gossip messages with NodeSigner

19c4468

wpaulino added 2 commits January 18, 2023 17:23

Use NodeSigner::ecdh to compute SharedSecrets

9133bea

Remove NodeSigner::get_node_secret

acd2ae6

Secrets should not be exposed in-memory at the interface level as it would be impossible the implement it against a hardware security module/secure element.

wpaulino force-pushed the remove-get-node-secret branch from 7fcbdf1 to acd2ae6 Compare January 19, 2023 01:23

arik-so approved these changes Jan 19, 2023

View reviewed changes

TheBlueMatt approved these changes Jan 19, 2023

View reviewed changes

TheBlueMatt merged commit 153b048 into lightningdevkit:main Jan 19, 2023

wpaulino deleted the remove-get-node-secret branch January 19, 2023 10:06

wpaulino mentioned this pull request Mar 3, 2023

Cut 0.0.114 #2065

Merged

Remove get_node_secret from NodeSigner #1951

Remove get_node_secret from NodeSigner #1951

Uh oh!

Conversation

wpaulino commented Jan 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov-commenter commented Jan 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arik-so left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheBlueMatt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheBlueMatt commented Jan 15, 2023

Uh oh!

arik-so commented Jan 18, 2023

Uh oh!

TheBlueMatt commented Jan 18, 2023

Uh oh!

Uh oh!

arik-so Jan 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wpaulino Jan 18, 2023

Choose a reason for hiding this comment

Uh oh!

arik-so Jan 19, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

wpaulino commented Jan 14, 2023 •

edited

Loading

codecov-commenter commented Jan 14, 2023 •

edited

Loading

arik-so Jan 18, 2023 •

edited

Loading