Skip to content

Commit 5e49486

Browse files
jonasschnellijonasschnelli
committed
Add BIP150 (Peer Authentication)
1 parent 932d43f commit 5e49486

File tree

2 files changed

+179
-0
lines changed

2 files changed

+179
-0
lines changed

‎README.mediawiki

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,12 @@ Those proposing changes should consider that ultimately consent may rest with th
518518
| Standard
519519
| Draft
520520
|-
521+
| [[bip-0150.mediawiki|150]]
522+
| Peer Authentication
523+
| Jonas Schnelli
524+
| Standard
525+
| Draft
526+
|-
521527
| [[bip-0151.mediawiki|151]]
522528
| Peer-to-Peer Communication Encryption
523529
| Jonas Schnelli

‎bip-0150.mediawiki

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
<pre>
2+
BIP: 150
3+
Title: Peer Authentication
4+
Author: Jonas Schnelli <[email protected]>
5+
Status: Draft
6+
Type: Standards Track
7+
Created: 2016-03-23
8+
</pre>
9+
10+
== Abstract ==
11+
12+
This BIP describes a way how peers can authenticate – without opening fingerprinting possibilities – to other peers to guarantee ownership and/or allowing to access additional or limited services.
13+
14+
== Motivation ==
15+
16+
We assume peer operators want to limit the access of different services or increase datastream priorities to a selective subset of peers. Also we assume peers want to connect to specific peers to broadcast or filter transactions (or similar action that reveals sensitive informations) and therefore they want to authenticate the remote peer and make sure that they have not connected to a MITM.
17+
18+
Benefits with peer authentication:
19+
* Peers could detect MITM attacks when connecting to known peers
20+
* Peers could allow resource hungry transaction filtering only to specific peers
21+
* Peers could allow access to sensitive information that can lead to node fingerprinting (fee estimation)
22+
* Peers could allow custom message types (private extensions) to authenticated peers
23+
24+
A simple authentication scheme based on elliptic cryptography will allow peers to identify each other and selective allow access to restricted services or reject the connection if the identity could not be verified.
25+
26+
== Specification ==
27+
28+
The authentication scheme proposed in this BIP uses ECDSA, '''secrets will never be transmitted'''.
29+
30+
'''Authentication initialization must only happen if encrypted channels have been established (according to BIP-151 [1]).'''
31+
32+
The '''encryption-session-ID''' is available once channels are encrypted (according to BIP-151 [1]).
33+
34+
The identity-public-keys used for the authentication must be pre-shared over a different channel (Mail/PGP, physical paper exchange, etc.). This BIP does not cover a "trust on first use" (TOFU) concept.
35+
36+
The authentication state must be kept until the encryption/connection terminates.
37+
38+
Only one authentication process is allowed per connection. Re-authenticate require re-establishing the connection.
39+
40+
=== Known-peers and authorized-peers database ===
41+
Each peer that supports p2p authentication must provide two users editable "databases"
42+
43+
# '''known-peers''' contains known identity-public-keys together with a network identifier (IP & port), similar to the "known-host" file supported by openssh.
44+
# '''authorized-peers''' contains authorized identity-public-keys
45+
46+
=== Local identity key management ===
47+
Each peer can configure multiple identity-keys (ECC, 32 bytes). Peers should make sure, each network interface (IPv4, IPv6, tor) has its own identity-key (otherwise it would be possible to link a tor address to a IPvX address).
48+
The identity-public-key(s) can be shared over a different channel with other node-operators (or non-validating clients) to grant authorized access.
49+
50+
=== Authentication procedure ===
51+
Authentication after this BIP will require both sides to authenticate. Signatures/public-keys will only be revealed if the remote peer could prove that they already know the remote identity-public-key.
52+
53+
# -> Requesting peer sends <code>AUTHCHALLENGE</code> (hash)
54+
# <- Responding peer sends <code>AUTHREPLY</code> (signature)
55+
# -> Requesting peer sends <code>AUTHPROPOSE</code> (hash)
56+
# <- Responding peer sends <code>AUTHCHALLENGE</code> (hash)
57+
# -> Requesting peer sends <code>AUTHREPLY</code> (signature)
58+
59+
For privacy reasons, dropping the connection or aborting during the authentication process must not be possible.
60+
61+
=== <code>AUTHCHALLENGE</code> message ===
62+
A peer can send an authentication challenge to see if the responding peer can produce a valid signature with the expected responding peers identity-public-key by sending an <code>AUTHCHALLENGE</code>-message to the remote peer.
63+
64+
The responding peer needs to check if the hash matches the hash calculated with his own local identity-public-key. Fingerprinting the requesting peer is not possible.
65+
66+
{|class="wikitable"
67+
! Field Size !! Description !! Data type !! Comments
68+
|-
69+
| 32bytes || challenge-hash || hash || <code>hash(encryption-session-ID || challenge_type || remote-peers-expected-identity-public-key)</code>
70+
|}
71+
72+
73+
<code>challenge_type</code> is a single character. <code>i</code> if the <code>AUTHCHALLENGE</code>-message is the first, requesting challenge or <code>r</code> if it's the second, remote peers challenge message.
74+
75+
=== <code>AUTHREPLY</code> message ===
76+
A peer must reply an <code>AUTHCHALLENGE</code>-message with an <code>AUTHREPLY</code>-message.
77+
78+
{|class="wikitable"
79+
! Field Size !! Description !! Data type !! Comments
80+
|-
81+
| 64bytes || signature || normalized comp.-signature || A signature of the encryption-session-ID done with the identity-key
82+
|}
83+
84+
If the challenge-hash from the <code>AUTHCHALLENGE</code>-message did not match the local authentication public-key, the signature must contain 64bytes of zeros.
85+
86+
The requesting peer can check the responding peers identity by checking the validity of the sent signature against with the pre-shared remote peers identity-public-key.
87+
88+
If the signature was invalid, the requesting peer must still proceed with the authentication by sending an <code>AUTHPROPOSE</code>-message with 32 random bytes.
89+
90+
=== <code>AUTHPROPOSE</code> message ===
91+
A peer can propose authentication of the channel by sending an <code>AUTHPROPOSE</code>-message to the remote peer.
92+
93+
If the signature sent in <code>AUTHREPLY</code> was invalid, the peer must still send an <code>AUTHPROPOSE</code>-message containing 32 random bytes.
94+
95+
The <code>AUTHPROPOSE</code> message must be answered with an <code>AUTHCHALLENGE</code>-message – even if the proposed requesting-peers identity-public-key has not been found in the authorized_peers database. In case of no match, the responding <code>AUTHCHALLENGE</code>-message must contains 32 bytes of zeros.
96+
97+
{|class="wikitable"
98+
! Field Size !! Description !! Data type !! Comments
99+
|-
100+
| 32bytes || auth-propose-hash || hash || <code>hash(encryption-session-ID || "p" || identity-public-key)</code>
101+
|}
102+
103+
== Post-Authentication Re-Keying ==
104+
105+
After the second <code>AUTHREPLY</code> message (requesting peers signature -> responding peer), both clients must re-key the symmetric encryption according to BIP151 while using '''a slightly different re-key key derivation hash'''.
106+
107+
They both re-key with <code>hash(encryption-session-ID || old_symmetric_cipher_key || requesting-peer-identity-public-key || responding-peer-identity-public-key)</code>
108+
109+
== Identity-Addresses ==
110+
The peers should display/log the identity-public-key as an identity-address to the users, which is a base58-check encoded ripemd160(sha256) hash. The purpose of this is for better visual comparison (logs, accept-dialogs).
111+
The base58check identity byte is <code>0x0F</code> followed by an identity-address version number (=<code>0xFF01</code>).
112+
113+
An identity address would look like <code>TfG4ScDgysrSpodWD4Re5UtXmcLbY5CiUHA</code> and can be interpreted as a remote peers fingerprint.
114+
115+
== Compatibility ==
116+
117+
This proposal is backward compatible. Non-supporting peers will ignore the new <code>AUTH*</code> messages.
118+
119+
== Example of an auth interaction ==
120+
121+
Before authentication (once during peer setup or upgrade)
122+
# Requesting peer and responding peer create each an identity-keypair (standard ECC priv/pubkey)
123+
# Requesting and responding peer share the identity-public-key over a different channel (PGP mail, physical exchange, etc.)
124+
# Responding peer stores requesting peers identity-public-key in its authorized-peers database (A)
125+
# Requesting peer stores responding peers identity-public-key in its known-peers database together with its IP and port (B)
126+
127+
Encryption
128+
# Encrypted channels must be established (according to BIP-151 [1])
129+
130+
Authentication
131+
# Requesting peer sends an <code>AUTHCHALLENGE</code> message
132+
AUTHCHALLENGE:
133+
[32 bytes, hash(encryption-session-ID || "i" || <remote-peers-expected-identity-public-key>)]
134+
135+
# Responding peer does create the same hash <code>(encryption-session-ID || "i" || <remote-peers-expected-identity-public-key>)</code> with its local identity-public-key
136+
# If the hash does not match, response with an <code>AUTHREPLY</code> message containing 64bytes of zeros.
137+
# In case of a match, response with an <code>AUTHREPLY</code> message
138+
AUTHREPLY:
139+
[64 bytes normalized compact ECDSA signature (H)] (sig of the encryption-session-ID done with the identity-key)
140+
141+
# Requesting peer does verify the signature with the <code>remote-peers-identity-public-key</code>
142+
# If the signature is invalid, requesting peer answers with an <code>AUTHREPLY</code> message containing 32 random bytes
143+
# In case of a valid signature, requesting peer sends an <code>AUTHPROPOSE</code> message
144+
AUTHPROPOSE:
145+
[32 bytes, hash(encryption-session-ID || "p" || <client-identity-public-key>)]
146+
147+
# Responding peer iterates over authorized-peers database (A), hashes the identical data and looks for a match.
148+
# If the hash does not match, responding peer answer with an <code>AUTHCHALLENGE</code> message containing 32 bytes of zeros.
149+
# In case of a match, responding peer sends an <code>AUTHCHALLENGE</code> message with the hashed client public-key
150+
AUTHCHALLENGE:
151+
[32 bytes, hash(encryption-session-ID || "r" || <client-identity-public-key>)]
152+
# Requesting peer sends an <code>AUTHREPLY</code> message containing 64 bytes of zeros if server failed to authenticate
153+
# Otherwise, response with signature in the <code>AUTHREPLY</code> message
154+
AUTHREPLY:
155+
[64 bytes normalized compact ECDSA signature (H)] (sig of the encryption-session-ID done with the identity-key)
156+
# Responding peer must verify the signature and can grant access to restricted services.
157+
# Both peers re-key the encryption after BIP151 including the requesting-peer-identity-public-key and responding-peer-identity-public-key
158+
159+
== Disadvantages ==
160+
161+
The protocol may be slow if a peer has a large authorized-peers database due to the requirement of iterating and hashing over all available authorized peers identity-public-keys.
162+
163+
== Reference implementation ==
164+
165+
== References ==
166+
167+
* [1] [[bip-0151.mediawiki|BIP 151: Peer-to-Peer Communication Encryption]]
168+
169+
== Acknowledgements ==
170+
* Gregory Maxwell and Pieter Wuille for most of the ideas in this BIP.
171+
172+
== Copyright ==
173+
This work is placed in the public domain.

0 commit comments

Comments
 (0)