getAlby / lightning-browser-extension

The Bitcoin Lightning Browser extension that connects to different wallet interfaces and brings deep lightning integration to the web
https://getalby.com
MIT License
530 stars 193 forks source link

Review lnurl-auth compatibility with Zeus, Blixxt,... #956

Open bumi opened 2 years ago

bumi commented 2 years ago

Describe the bug LNURL-auth with LND does not generate the same key as Zeus.

To Reproduce Steps to reproduce the behavior:

  1. Connect a LND node
    1. Visit stacker.news
    2. login with lightning
  2. Use Zeus and connect the same LND
    1. Visit stacker.news
    2. login with lightning

Those should log you into the same account.

Expected behavior The lnurl-auth should create the same keys.

Information About Alby

Further info:

bumi commented 2 years ago

There seems to be in issue with the hmac generation:

we use crypto.js hmacSHA256 zeus uses HMAC from fast-sha256

const hashingKey = '...'
//Alby
const AlinkingKeyPriv = hmacSHA256("getalby.com", hashingKey).toString(Hex);
console.log({ AlinkingKeyPriv });

//Zeus
const ZlinkingKeyPriv = new sha256HMAC(Buffer.from(hashingKey, "hex"))
  .update(stringToUint8Array("getalby.com"))
  .digest();
console.log({ ZlinkingKeyPriv });