BREAKING: NUT-04: payment_hash -> hash

[callebtc]

Critical update. We need to fix NUT-04 to not use the bolt11 payment_hash as this enables a third party to steal tokens from a user if they publicly post a Cashu invoice online or leak it in any other way. An attacker could compute the payment_hash and start hitting the mint with POST /mint requests until the invoice is paid. If the attacker is faster than the user, they get the ecash.

What do we need to change?

Wallets:

• Very easy: simply rename the URL param from payment_hash to hash in POST /mint. You received the hash in the previous step when you called GET /mint.
• This is simply for semantic consistency (as we're not using a payment hash anymore). An option would be to make mints backwards compatible for a transition period and accept both parameters.

Mints:

• Medium easy: instead of returning the payment hash in NUT-03: GET /mint, generate a random urlsafe string to look up the invoice state later in POST /mint. This either has to be stored in a database (so it can be mapped back to the invoice) or it could be encrypted with the private key of the mint (which would make it stateless).
• Any comments on these approaches are appreciated, especially from mint devs.
• Edit: It seems the easiest way to implement this in a mint would be to encrypt the payment_hash with the mint's private key (or: the hash of the private key string). Then pass that encrypted (random-looking) string we call hash to the user upon GET /mint. When the user then asks for POST /mint, the mint takes hash, decrypts it with the private key and gets payment_hash that can be used to look up the invoice state in the Lightning backend.

Tracking progress of NUT-04 update (please report):

• Nutshell (Status: ✅ PR)
• LNbits (Status: ✅ PR)
• Feni (Status: ✅ PR)
• Cashu.me (Status: ✅ PR)
• Nutstash (Status: ✅ PR)
• Peanut
• cashu-ts (Status: ✅ PR)
• ngutech21/cashu-rs (Status: ✅ commit)
• clarkmoody/cashu-rs (Status: ✅ commit)
• cashu-crab (Status: ✅ commit)

Ping: @Egge7 @BilligsterUser @gandlafbtc @clarkmoody @ngutech21 @gohumble @thesimplekid @KKA11010

[BilligsterUser]

LGTM

[BilligsterUser]

cashu-ts => pr #60

[clarkmoody]

ACK

Fixed in clarkmoody/cashu-rs@64102ea

[gandlafbtc]

LGTM

[gandlafbtc]

merged on cashu-ts , not yet in a release

[ngutech21]

Fixed in ngutech21/moksha@9e4020f

[callebtc]

@gohumble @ngutech21 @clarkmoody please confirm that the hash you're producing is urlsafe (since we're using it in a URL param)! 🙏

[thesimplekid]

Fixed in cashubtc/cdk@d138135

[gandlafbtc]

https://github.com/cashubtc/cashu-ts/releases/tag/v0.7.2

[ngutech21]

@gohumble @ngutech21 @clarkmoody please confirm that the hash you're producing is urlsafe (since we're using it in a URL param)! 🙏

it is hereby confirmed

[clarkmoody]

@gohumble @ngutech21 @clarkmoody please confirm that the hash you're producing is urlsafe (since we're using it in a URL param)! 🙏

Yes, I'm encoding as hex.

[callebtc]

Thank you everyone for a smooth coordinated upgrade like the Solana people.