I'm developing API library for LND REST API.
POST /v1/invoices requires
Should I generate it or LND can do it itself if I'll not specify it?
If I should do that - how to do it properly? General description would be enough.
As a rule of thumb it is probably best to let lnd generate the preimage for you.
If someone can guess your preimage they have the chance of steeling the payment. It is somewhat similar to guessing your Bitcoin private keys but probably not as bad as they can only get the current payment and technically even that might be tricky.
If you want to do it alone you should keep in mind three things :
- The preimage should be truly random which for software is always hard to achieve
- It should have a large enough size. Flipping a coin might be truely random but as there are only two possible outcomes one could guess / brute force those
- It should be unique and never reused.
The third point is achieved in precise by following the first two points.
Also looking at BOLT 02 https://github.com/lightningnetwork/lightning-rfc/blob/master/02-peer-protocol.md#removing-an-htlc-update_fulfill_htlc-update_fail_htlc-and-update_fail_malformed_htlc you will see that the preimage is 32 bytes of data which gives you even less flexibility than my second point suggested.