Author: Anthony Towns 2015-10-21 03:43:10
Published on: 2015-10-21T03:43:10+00:00
In an email thread from October 21, 2015, Rusty Russell proposed using a session nonce to improve security after the first handshake in a system. Although the nonce can help with correlation, it needs to change to maintain security. Russell suggested using sha256() of some shared secret along with an incremented number for each successful handshake. ECDH of node ids would be the obvious shared secret to use as a base. However, Russell notes that determining what constitutes a successful handshake is vague and may require allowing +/- 1 nonce. Russell also acknowledges that using a nonce may overcomplicate things since nodes are already publishing their ids and IPs in a public IRC channel. Therefore, he suggests tabling the proposal for now.
Updated on: 2023-05-18T15:30:01.752892+00:00