DeriveSharedKey

DeriveSharedKey returns a shared secret key by performing Diffie-Hellman key derivation between the ephemeral public key in the request and the node's key specified in the key_desc parameter. Either a key locator or a raw public key is expected in the key_desc, if neither is supplied, defaults to the node's identity private key: P_shared = privKeyNode * ephemeralPubkey The resulting shared public key is serialized in the compressed format and hashed with sha256, resulting in the final key length of 256bit.

Source: signrpc/signer.proto

gRPC

rpc DeriveSharedKey (SharedKeyRequest) returns (SharedKeyResponse);

REST

HTTP Method	Path
POST	/v2/signer/sharedkey

Code Samples

gRPC

Javascript

const fs = require('fs');
const grpc = require('@grpc/grpc-js');
const protoLoader = require('@grpc/proto-loader');

const GRPC_HOST = 'localhost:10009'
const MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'
const TLS_PATH = 'LND_DIR/tls.cert'

const loaderOptions = {
  keepCase: true,
  longs: String,
  enums: String,
  defaults: true,
  oneofs: true,
};
const packageDefinition = protoLoader.loadSync(['lightning.proto', 'signrpc/signer.proto'], loaderOptions);
const signrpc = grpc.loadPackageDefinition(packageDefinition).signrpc;
process.env.GRPC_SSL_CIPHER_SUITES = 'HIGH+ECDSA';
const tlsCert = fs.readFileSync(TLS_PATH);
const sslCreds = grpc.credentials.createSsl(tlsCert);
const macaroon = fs.readFileSync(MACAROON_PATH).toString('hex');
const macaroonCreds = grpc.credentials.createFromMetadataGenerator(function(args, callback) {
  let metadata = new grpc.Metadata();
  metadata.add('macaroon', macaroon);
  callback(null, metadata);
});
let creds = grpc.credentials.combineChannelCredentials(sslCreds, macaroonCreds);
let client = new signrpc.Signer(GRPC_HOST, creds);
let request = {
  ephemeral_pubkey: <bytes>,
  key_loc: <KeyLocator>,
  key_desc: <KeyDescriptor>,
};
client.deriveSharedKey(request, function(err, response) {
  console.log(response);
});
// Console output:
//  {
//    "shared_key": <bytes>,
//  }

Python

import codecs, grpc, os
# Generate the following 2 modules by compiling the signrpc/signer.proto with the grpcio-tools.
# See https://github.com/lightningnetwork/lnd/blob/master/docs/grpc/python.md for instructions.
import signer_pb2 as signrpc, signer_pb2_grpc as signerstub

GRPC_HOST = 'localhost:10009'
MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'
TLS_PATH = 'LND_DIR/tls.cert'

# create macaroon credentials
macaroon = codecs.encode(open(MACAROON_PATH, 'rb').read(), 'hex')
def metadata_callback(context, callback):
  callback([('macaroon', macaroon)], None)
auth_creds = grpc.metadata_call_credentials(metadata_callback)
# create SSL credentials
os.environ['GRPC_SSL_CIPHER_SUITES'] = 'HIGH+ECDSA'
cert = open(TLS_PATH, 'rb').read()
ssl_creds = grpc.ssl_channel_credentials(cert)
# combine macaroon and SSL credentials
combined_creds = grpc.composite_channel_credentials(ssl_creds, auth_creds)
# make the request
channel = grpc.secure_channel(GRPC_HOST, combined_creds)
stub = signerstub.SignerStub(channel)
request = signrpc.SharedKeyRequest(
  ephemeral_pubkey=<bytes>,
  key_loc=<KeyLocator>,
  key_desc=<KeyDescriptor>,
)
response = stub.DeriveSharedKey(request)
print(response)
# {
#    "shared_key": <bytes>,
# }

REST

Javascript

const fs = require('fs');
const request = require('request');

const REST_HOST = 'localhost:8080'
const MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'

let requestBody = {
  ephemeral_pubkey: <string>, // <bytes> (base64 encoded)
  key_loc: <object>, // <KeyLocator> 
  key_desc: <object>, // <KeyDescriptor> 
};
let options = {
  url: `https://${REST_HOST}/v2/signer/sharedkey`,
  // Work-around for self-signed certificates.
  rejectUnauthorized: false,
  json: true,
  headers: {
    'Grpc-Metadata-macaroon': fs.readFileSync(MACAROON_PATH).toString('hex'),
  },
  form: JSON.stringify(requestBody),
}
request.post(options, function(error, response, body) {
  console.log(body);
});
// Console output:
//  {
//    "shared_key": <string>, // <bytes> 
//  }

Python

import base64, codecs, json, requests

REST_HOST = 'localhost:8080'
MACAROON_PATH = 'LND_DIR/data/chain/bitcoin/regtest/admin.macaroon'
TLS_PATH = 'LND_DIR/tls.cert'

url = f'https://{REST_HOST}/v2/signer/sharedkey'
macaroon = codecs.encode(open(MACAROON_PATH, 'rb').read(), 'hex')
headers = {'Grpc-Metadata-macaroon': macaroon}
data = {
  'ephemeral_pubkey': base64.b64encode(<bytes>),
  'key_loc': <KeyLocator>,
  'key_desc': <KeyDescriptor>,
}
r = requests.post(url, headers=headers, data=json.dumps(data), verify=TLS_PATH)
print(r.json())
# {
#    "shared_key": <bytes>,
# }

Shell

# There is no CLI command for this RPC

Messages

signrpc.SharedKeyRequest

Source: signrpc/signer.proto

Field	gRPC Type	REST Type	REST Placement
ephemeral_pubkey The ephemeral public key to use for the DH key derivation.	bytes	string	body
key_locdeprecated Deprecated. The optional key locator of the local key that should be used. If this parameter is not set then the node's identity private key will be used.	KeyLocator	object	body
key_desc A key descriptor describes the key used for performing ECDH. Either a key locator or a raw public key is expected, if neither is supplied, defaults to the node's identity private key.	KeyDescriptor	object	body

signrpc.SharedKeyResponse

Source: signrpc/signer.proto

Field	gRPC Type	REST Type
shared_key The shared public key, hashed with sha256.	bytes	string

Nested Messages

signrpc.KeyDescriptor

Field	gRPC Type	REST Type
raw_key_bytes The raw bytes of the public key in the key pair being identified. Either this or the KeyLocator must be specified.	bytes	string
key_loc The key locator that identifies which private key to use for signing. Either this or the raw bytes of the target public key must be specified.	KeyLocator	object

signrpc.KeyLocator

Field	gRPC Type	REST Type
key_family The family of key being identified.	int32	integer
key_index The precise index of the key being identified.	int32	integer