Add an ExpandedKey key for phantom blinded path authentication

In the coming commits we'll add support for building a blinded path
which can be received to any one of several nodes in a "phantom"
configuration (terminology we retain from BOLT 11 though there are
no longer any phantom nodes in the paths).

Here we adda new key in `ExpandedKey` which we can use to
authenticate blinded paths as coming from a phantom node
participant.

Author: TheBlueMatt

lightning/src/crypto/utils.rs

@@ -22,7 +22,7 @@ macro_rules! hkdf_extract_expand {
 		let (k1, k2, _) = hkdf_extract_expand!($salt, $ikm);
 		(k1, k2)
 	}};
-	($salt: expr, $ikm: expr, 6) => {{
+	($salt: expr, $ikm: expr, 7) => {{
 		let (k1, k2, prk) = hkdf_extract_expand!($salt, $ikm);
 
 		let mut hmac = HmacEngine::<Sha256>::new(&prk[..]);
@@ -45,18 +45,23 @@ macro_rules! hkdf_extract_expand {
 		hmac.input(&[6; 1]);
 		let k6 = Hmac::from_engine(hmac).to_byte_array();
 
-		(k1, k2, k3, k4, k5, k6)
+		let mut hmac = HmacEngine::<Sha256>::new(&prk[..]);
+		hmac.input(&k6);
+		hmac.input(&[7; 1]);
+		let k7 = Hmac::from_engine(hmac).to_byte_array();
+
+		(k1, k2, k3, k4, k5, k6, k7)
 	}};
 }
 
 pub fn hkdf_extract_expand_twice(salt: &[u8], ikm: &[u8]) -> ([u8; 32], [u8; 32]) {
 	hkdf_extract_expand!(salt, ikm, 2)
 }
 
-pub fn hkdf_extract_expand_6x(
+pub fn hkdf_extract_expand_7x(
 	salt: &[u8], ikm: &[u8],
-) -> ([u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32]) {
-	hkdf_extract_expand!(salt, ikm, 6)
+) -> ([u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32], [u8; 32]) {
+	hkdf_extract_expand!(salt, ikm, 7)
 }
 
 #[inline]

lightning/src/ln/inbound_payment.rs

@@ -15,7 +15,7 @@ use bitcoin::hashes::sha256::Hash as Sha256;
 use bitcoin::hashes::{Hash, HashEngine};
 
 use crate::crypto::chacha20::ChaCha20;
-use crate::crypto::utils::hkdf_extract_expand_6x;
+use crate::crypto::utils::hkdf_extract_expand_7x;
 use crate::ln::msgs;
 use crate::ln::msgs::MAX_VALUE_MSAT;
 use crate::offers::nonce::Nonce;
@@ -56,6 +56,10 @@ pub struct ExpandedKey {
 	/// The key used to authenticate spontaneous payments' metadata as previously registered with LDK
 	/// for inclusion in a blinded path.
 	spontaneous_pmt_key: [u8; 32],
+	/// The key used to authenticate phantom-node-shared blinded paths as generated by us. Note
+	/// that this is not used for blinded paths that are not expected to be shared across nodes
+	/// participating in a "phantom node".
+	pub(crate) phantom_node_blinded_path_key: [u8; 32],
 }
 
 impl ExpandedKey {
@@ -70,14 +74,16 @@ impl ExpandedKey {
 			offers_base_key,
 			offers_encryption_key,
 			spontaneous_pmt_key,
-		) = hkdf_extract_expand_6x(b"LDK Inbound Payment Key Expansion", &key_material);
+			phantom_node_blinded_path_key,
+		) = hkdf_extract_expand_7x(b"LDK Inbound Payment Key Expansion", &key_material);
 		Self {
 			metadata_key,
 			ldk_pmt_hash_key,
 			user_pmt_hash_key,
 			offers_base_key,
 			offers_encryption_key,
 			spontaneous_pmt_key,
+			phantom_node_blinded_path_key,
 		}
 	}