geth inter-node communication (devp2p/rlpx) encryption

Question

I am currently analysing the encryption mechanisms used in geth.

Currently I have gathered the following information from the source code (https://github.com/ethereum/go-ethereum/blob/master/p2p/rlpx.go):

• communication is encrypted
• no server certificate / CA chains like in TLS
• Key Exchange via: ECDSA / secp256k1
• ECDSA publicKeyLength: 256-bit
• SharedSecretKeyLength: 16-byte

Is this correct so far?

Does someone know if there is any documentation on encryption in the inter-node protocol?

Update From https://github.com/ethereum/devp2p/blob/master/rlpx.md (thanks Richard Horrocks for pointing to it):

The RLPx handshake is considered 'broken crypto' because aes-secret and mac-secret are reused for both reading and writing. The two sides of a RLPx connection generate two CTR streams from the same key, nonce and IV. If an attacker knows one plaintext, they can decrypt unknown plaintexts of the reused keystream.

Update Asked at crypto.stackexchange.com about the encryption flaw above -> https://crypto.stackexchange.com/questions/63047/ethereum-rlpx-protocol-for-inter-node-communication-flaws-in-the-encryption

Answer 1

Does someone know if there is any documentation on encryption in the inter-node protocol?

You might have already found these, but here are few sources I've used in the past:

• https://github.com/ethereum/devp2p/blob/master/rlpx.md (The RLPx Transport Protocol)
• https://github.com/ethereum/devp2p/blob/master/devp2p.md (devp2p Application Protocol)

Gitter channel: https://gitter.im/ethereum/devp2p

Consensys's Wireshark dissectors for devp2p: https://github.com/ConsenSys/ethereum-dissectors