search

ElementsProject / lightning

Core Lightning — Lightning Network implementation focusing on spec compliance and performance
Other
2.86k stars 905 forks source link

Incorrect comment hints at security problem with channel key reuse #7682

Open devrandom opened 1 month ago

devrandom commented 1 month ago

hsmd.c has the following comment:

        /*~ This is a unique value handed to us from lightningd, used for
     * per-channel seed generation (a single id may have multiple channels
     * over time).
     *
     * It's actually zero for the initial lightningd client connection and
     * the ones for gossipd and connectd, which don't have channels
     * associated. */
    u64 dbid;

This is hopefully not correct, because reusing channel keys is a security problem (revocation secrets must not be reused).