From: Tom <tomz@freedommail.ch>
To: bitcoin-dev@lists.linuxfoundation.org
Date: Fri, 25 Mar 2016 10:36:28 +0000
Message-ID: <2590065.B4dTBeyc1A@garp>
In-Reply-To: <56F310D6.2070002@jonasschnelli.ch>
References: <56F2B51C.8000105@jonasschnelli.ch> <1983116.UNQS71VxHo@garp>
	<56F310D6.2070002@jonasschnelli.ch>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Subject: Re: [bitcoin-dev] p2p authentication and encryption BIPs
Precedence: list

On Wednesday 23 Mar 2016 22:55:34 Jonas Schnelli via bitcoin-dev wrote:
> >> I have just PRed a draft version of two BIPs I recently wrote.
> > * why would you not allow encryption on non-pre-approved connections?
> 
> The encryption should be optional.
> The proposed authentication scheme does take care of the
> identity-management and therefor prevent MITM attacks.
> Without the identity management, you might not detect sending/receiving
> encrypted data from/to a MITM.

If you want to extend the Bitcoin protocol itself, you will have to resolve 
that. Which many other solutions do (ssh for instance).

It would not be Ok to have an peer-to-peer encryption system that doesn't 
allow non-pre-approved connections.

> > * What is the reason for using the p2p code to connect a wallet to a node?
> > I suggest using one of the other connection methods to connect to the
> > node.
> > This avoids a change in the bitcoin protocol for a very specific usecase.
> 
> Most known use-case: SPV.

You didn't answer the question.

> > * Why do you want to do a per-message encryption (wrapping the original)?
> > Smaller messages that contain predictable content and are able to be
> > matched to the unencrypted versions on the wire send to other nodes will
> > open this scheme up to various old statistical attacks.
> 
> It's probably extremely inefficient to create a constant time stream.

Your use of "probably" makes me wonder if you already have an implementation. 
Doing any encryption and handshaking design *without* actually having it coded 
and gone though testing yet makes no sense.
I do not belief Bitcoin will benefit from "design by committee" where a 
specification is drawn before an implementation is written.

Also, you didn't actually address the attack-vector.

 
> >> Responding peers must ignore (banning would lead to fingerprinting) the
> > 
> > requesting peer after 5 unsuccessfully authentication tries to avoid
> > resource attacks.
> > 
> > Any implementation of that kind would itself again be open to resource
> > attacks.
> > Why 5? Do you want to allow a node to make a typo?
> 
> Good point. Maybe one false try should lead to ignoring the peer.

That doesn't take away the resource attack at all.

 
> >> To ensure that no message was dropped or blocked, the complete
> >> communication> 
> > must be hashed (sha256). Both peers keep the SHA256 context of the
> > encryption session. The complete <code>enc</code> message (leaving out
> > the hash itself) must be added to the hash-context by both parties.
> > Before sending a <code>enc</code> command, the sha256 context will be
> > copied and finalized.
> > 
> > You write "the complete communication must be hashed" and every message
> > has a hash of the state until it is at that point.
> > I think you need to explain how that works specifically.
> 
> This is a relative simple concept and does not require rehashing the
> whole communication. 

Apologies, I should have been more clear; the BIP should specify the actual 
algorithm, otherwise you can't create an implementation from just reading the 
BIP.

Also, this may be a good time to ask why you want to have a per-message 
encryption?
Practically every single popular end-to-end encryption uses one approach or 
another were it just encrypts as another layer. (the  L in ssl). You are 
mixing layers, and unless you do that for a very good reason, or have a very 
good reason why everyone else is doing it wrong, I suggest using a layered 
encryption approach.