To: bitcoin-dev@lists.linuxfoundation.org, eth3rs@gmail.com
References: <87h9cecad5.fsf@rustcorp.com.au>
	<577224E8.6070307@jonasschnelli.ch> <8760ssdd1u.fsf@rustcorp.com.au>
	<CAEM=y+XKQZVz6UieB-nDy_C9xTmXiBB3-atuuZkxzmPoSVPOJw@mail.gmail.com>
	<CAPg+sBj3QRGYUzJn96ZS4bf1ZEH9KTwF+OxPXE-O_YJA66grBg@mail.gmail.com>
	<CAEM=y+X5uT+UbB1f6+ynsWW4ZsxEE4X0-PbHqWXEWz_mUj8Y2w@mail.gmail.com>
From: Jonas Schnelli <dev@jonasschnelli.ch>
Message-ID: <57741769.7040300@jonasschnelli.ch>
Date: Wed, 29 Jun 2016 20:46:01 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0)
	Gecko/20100101 Thunderbird/38.7.2
MIME-Version: 1.0
In-Reply-To: <CAEM=y+X5uT+UbB1f6+ynsWW4ZsxEE4X0-PbHqWXEWz_mUj8Y2w@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature";
	boundary="1LkggroRLCofs5vQIQAxPbKuLDTC2I7oN"
Subject: Re: [bitcoin-dev] BIP 151 use of HMAC_SHA512
Precedence: list

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--1LkggroRLCofs5vQIQAxPbKuLDTC2I7oN
Content-Type: multipart/mixed; boundary="p2QXdXXObO54P4c7gpLUBEELqj6VXK7AE"
From: Jonas Schnelli <dev@jonasschnelli.ch>
To: bitcoin-dev@lists.linuxfoundation.org, eth3rs@gmail.com
Message-ID: <57741769.7040300@jonasschnelli.ch>
Subject: Re: [bitcoin-dev] BIP 151 use of HMAC_SHA512
References: <87h9cecad5.fsf@rustcorp.com.au>
 <577224E8.6070307@jonasschnelli.ch> <8760ssdd1u.fsf@rustcorp.com.au>
 <CAEM=y+XKQZVz6UieB-nDy_C9xTmXiBB3-atuuZkxzmPoSVPOJw@mail.gmail.com>
 <CAPg+sBj3QRGYUzJn96ZS4bf1ZEH9KTwF+OxPXE-O_YJA66grBg@mail.gmail.com>
 <CAEM=y+X5uT+UbB1f6+ynsWW4ZsxEE4X0-PbHqWXEWz_mUj8Y2w@mail.gmail.com>
In-Reply-To: <CAEM=y+X5uT+UbB1f6+ynsWW4ZsxEE4X0-PbHqWXEWz_mUj8Y2w@mail.gmail.com>

--p2QXdXXObO54P4c7gpLUBEELqj6VXK7AE
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Hi Ethan


>> It is important to include the cipher-type into the symmetric cipher k=
ey to avoid weak-cipher-attacks.
>=20
> the cipher-type here refers to the ECDH negotiation parameters?

No. Not to the ECDH negotiation.
BIP151 specifies a flexible symmetric key cipher type negotiation,
although, BIP151 only specifies chacha20-poly1305@openssh.com.

Lets assume someone adds another symmetric cipher type after BIP151 has
been deployed which has less strong security properties then
chacha20-poly1305.

If we don't include the ciphersuite-type in the key derivation HMAC, an
attacker/MITM could in theory force both nodes to use the weaker
symmetric cipher type.

</jonas>


--p2QXdXXObO54P4c7gpLUBEELqj6VXK7AE--

--1LkggroRLCofs5vQIQAxPbKuLDTC2I7oN
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXdBdpAAoJECnUvLZBb1PsTHUP/0wmVZcJQbDeVrMvR95ycznU
m0m0uweWGCLaIf0g6JHzkoSPwp244DoqpJCvmzVDTcsveu07X1sGKeYkLfPP8YPx
3KmvOFPGTKnxNIvKBmsv/7BORs6XmBQAWAVzyVf5eVzebSn2VkVw2oSv69xWV+IX
R24bH9km8D3q8QPeM+jBvKuAqYEoGK9bgE6XuaVg17vJgZ5j/1V9GY8Lx8u3ODKI
FUT7Ti1dTcEik7ik/gXD4UmBogbkAqUi/iBbY/YZA22cdSbQQ5pFvaJ3ulQ+307n
HZ1Kz03+k9yA7Obq2LORR0zMZ0m+BggeLXAvvFZLkq1VwRtCHhYi1eRKOJD+Geni
hYGjtbtlj96HBmQ7PC/zMpwevTInxOm6xrJ/PZthFIhrmhRBueCIrrtQ4yhsZ9dZ
wDrfS+RZ3wcMxD1AF4cewHs4PEkMlQaydneQxqjdUy8Kl7QRQQCwMqJum2lJ3HQ9
8Y4z+jhX6clp5wZy/xg/yynUnO6x4bydKhTf0Xr/k3ZU831zxbPk/l1KzKfga1bD
lX2lDf3/Le8z0BS5tcgGPXubA4seVhpH+2xMRtEs+9rd1/ey+o3gyxjThpl4kgDo
aNd3or+yFpdZQ26PG4+wr+ljg7VDWM6tp8rX7eC8yIHQns6DQS7zO5LRe/+jrasr
Adh32clYB61L+0NLvzqj
=1dln
-----END PGP SIGNATURE-----

--1LkggroRLCofs5vQIQAxPbKuLDTC2I7oN--