0
$\begingroup$

Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref)

Under Known-Issues I found this paragraph:

The RLPx handshake is considered 'broken crypto' because aes-secret and mac-secret are reused for both reading and writing. The two sides of a RLPx connection generate two CTR streams from the same key, nonce and IV. If an attacker knows one plaintext, they can decrypt unknown plaintexts of the reused keystream.

Q: Can someone please Explain what this means and how this can be exploited by a third party who is able to observe the encrypted communication between two nodes.

Related to: https://ethereum.stackexchange.com/questions/59549/geth-inter-node-communication-devp2p-rlpx-encryption

$\endgroup$
2
$\begingroup$

Firstly, CTR mode. This is a stream mode that allows a block cipher (AES here) to work as a stream cipher.

Given $(k,IV)$ where $k$ is a random encryption key and $IV$ is an initialization vector, CTR mode works in this way:

For the $i$th message $m_i$ (less than the block size):

To encrypt: compute $c_i=E_{k}(IV||i)\oplus m_i$;

To decrypt: compute $m_i=E_{k}(IV||i)\oplus c_i$;

Now the two streams use the same key and IV, so if the plaintext of $m_i$ in one stream is known by an attacker (e.g. this is a fixed field like a header or something), the attacker can recover the plaintext $m_i'$ in the other stream.

Stream 1: $c_i=E_{k}(IV||i)\oplus m_i$;

I know $m_i$, so I can recover the key stream for this block:

$E_{k}(IV||i)\oplus m_i\oplus m_i=E_{k}(IV||i)$

Then given the ciphertext $c_i' =E_{k}(IV||i)\oplus m_i'$ in the other stream, I can recover $m_i'$ because the keystream used in encryption is the same:

$E_{k}(IV||i)\oplus m_i'\oplus E_{k}(IV||i)=m_i'$

$\endgroup$
  • $\begingroup$ Thank you for your answer. There is one point that I still don’t understand: why is this actually bad? The scope is only read/write stream of one connection, right? Sender and receiver have to know the plain texts anyway. Or is it possible to decrypt also other connections based on this knowledge? $\endgroup$ – ivicaa Oct 13 '18 at 5:48
  • 1
    $\begingroup$ The same key is used to encrypt two streams, which sends different data. If one party sends $p_1$ through one stream and the plaintext $p_1$ is somehow known by a third party adversary, that will allow the adversary to decrypt $p_2$ in the other stream that the adversary knew nothing about. This is a know-plaintext or chosen-plaintext attack. $\endgroup$ – Changyu Dong Oct 13 '18 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.