# Ethereum RLPx protocol for inter-node communication - flaws in the encryption

Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref)

Under Known-Issues I found this paragraph:

The RLPx handshake is considered 'broken crypto' because aes-secret and mac-secret are reused for both reading and writing. The two sides of a RLPx connection generate two CTR streams from the same key, nonce and IV. If an attacker knows one plaintext, they can decrypt unknown plaintexts of the reused keystream.

Q: Can someone please Explain what this means and how this can be exploited by a third party who is able to observe the encrypted communication between two nodes.

Firstly, CTR mode. This is a stream mode that allows a block cipher (AES here) to work as a stream cipher.

Given $$(k,IV)$$ where $$k$$ is a random encryption key and $$IV$$ is an initialization vector, CTR mode works in this way:

For the $$i$$th message $$m_i$$ (less than the block size):

To encrypt: compute $$c_i=E_{k}(IV||i)\oplus m_i$$;

To decrypt: compute $$m_i=E_{k}(IV||i)\oplus c_i$$;

Now the two streams use the same key and IV, so if the plaintext of $$m_i$$ in one stream is known by an attacker (e.g. this is a fixed field like a header or something), the attacker can recover the plaintext $$m_i'$$ in the other stream.

Stream 1: $$c_i=E_{k}(IV||i)\oplus m_i$$;

I know $$m_i$$, so I can recover the key stream for this block:

$$E_{k}(IV||i)\oplus m_i\oplus m_i=E_{k}(IV||i)$$

Then given the ciphertext $$c_i' =E_{k}(IV||i)\oplus m_i'$$ in the other stream, I can recover $$m_i'$$ because the keystream used in encryption is the same:

$$E_{k}(IV||i)\oplus m_i'\oplus E_{k}(IV||i)=m_i'$$

• Thank you for your answer. There is one point that I still don’t understand: why is this actually bad? The scope is only read/write stream of one connection, right? Sender and receiver have to know the plain texts anyway. Or is it possible to decrypt also other connections based on this knowledge? – ivicaa Oct 13 '18 at 5:48
• The same key is used to encrypt two streams, which sends different data. If one party sends $p_1$ through one stream and the plaintext $p_1$ is somehow known by a third party adversary, that will allow the adversary to decrypt $p_2$ in the other stream that the adversary knew nothing about. This is a know-plaintext or chosen-plaintext attack. – Changyu Dong Oct 13 '18 at 7:52