Ethereum RLPx protocol for inter-node communication - flaws in the encryption

Question

Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref)

Under Known-Issues I found this paragraph:

The RLPx handshake is considered 'broken crypto' because aes-secret and mac-secret are reused for both reading and writing. The two sides of a RLPx connection generate two CTR streams from the same key, nonce and IV. If an attacker knows one plaintext, they can decrypt unknown plaintexts of the reused keystream.

Q: Can someone please Explain what this means and how this can be exploited by a third party who is able to observe the encrypted communication between two nodes.

Related to: https://ethereum.stackexchange.com/questions/59549/geth-inter-node-communication-devp2p-rlpx-encryption

Answer 1

Firstly, CTR mode. This is a stream mode that allows a block cipher (AES here) to work as a stream cipher.

Given $(k,IV)$ where $k$ is a random encryption key and $IV$ is an initialization vector, CTR mode works in this way:

For the $i$th message $m_i$ (less than the block size):

To encrypt: compute $c_i=E_{k}(IV||i)\oplus m_i$;

To decrypt: compute $m_i=E_{k}(IV||i)\oplus c_i$;

Now the two streams use the same key and IV, so if the plaintext of $m_i$ in one stream is known by an attacker (e.g. this is a fixed field like a header or something), the attacker can recover the plaintext $m_i'$ in the other stream.

Stream 1: $c_i=E_{k}(IV||i)\oplus m_i$;

I know $m_i$, so I can recover the key stream for this block:

$E_{k}(IV||i)\oplus m_i\oplus m_i=E_{k}(IV||i)$

Then given the ciphertext $c_i' =E_{k}(IV||i)\oplus m_i'$ in the other stream, I can recover $m_i'$ because the keystream used in encryption is the same:

$E_{k}(IV||i)\oplus m_i'\oplus E_{k}(IV||i)=m_i'$