BIP324 Jonas Schnelli / dev@jonasschnelli.ch / Breaking Bitcoin 8th June 2019 PGP: CA1A2908DCE2F13074C62CDE1EB776BB03C7922D V2 MESSAGE TRANSPORT PROTOCOL
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Goals of the v2 proposal ‣ Opportunistic Encryption ‣ Eliminate passive non detectable observing ‣ Eliminate non detectable message manipulation ‣ Optimize protocol ‣ Extendable with various authentication schemes
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Why V2? ‣ People did start implementing BIP151 ‣ Major differences to BIP151 ‣ New message structure ‣ New service flag ‣ Short Command IDs ‣ Opportunistic encryption
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Why encryption? ‣ The blockchain data is public, the general traffic of the Bitcoin network is not ‣ The Bitcoin network is under active surveillance ‣ Eliminate passive non detectable observing ‣ Eliminate non detectable message tempering ‣ Building block for secure connections
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Required crypto primitives ‣ ECDH secp256k1 ‣ HKDF SHA256 L32 ‣ ChaCha20 ‣ Poly1305
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Handshake Initiator (V2) Responder (V2) 32 bytes Read 32 pubkey bytes No Has net magic & „version“? 32 bytes ECDH pubkey Yes ECDH V1 protocol Enable encryption Enable Read version encryption msg
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Handshake Initiator Responder x, X := Generate Secp256k1 Keypair (only odd pub keys are allowed) send pubkey X (no message structure, pure 32 bytes) y, Y := Generate Secp256k1 Keypair (only odd pub keys are allowed) SS := Secp256k1_ECDH(X, y) send pubkey Y (no message structure, pure 32 bytes) SS := Secp256k1_ECDH (Y, x)
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Handshake ‣ No message structure ‣ Pure 32byte handshake payload ‣ Only ODD pubkeys ‣ Only pubkeys not starting with the V1 network magic ‣ V1 Compatibility: fallback option to a version msg
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Session ID and keys PRK = HKDF_SHA256_L32( BitcoinSharedSecret || INITIATOR_32BYTES_PUBKEY||RESPONDER_32BYTES_PUBKEY ) k1-k4 = HKDF_SHA256_L32_EXPAND(PRK, „ BitcoinK_1 - K4“ ) SessionID = HKDF_SHA256_L32_EXPAND(PRK, „ BitcoinSessionID“ )
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Handshake MITM Initiator (V2) MITM Responder (V2) HandShake Handshake Request Request Handshake Handshake Response Response Encrypted Encrypted message message Encrypted Encrypted message message
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Handshake Initiator (V2) MITM Responder (V2) Session ID X Session ID X Session ID Y Session ID Y HandShake Handshake Request Request Handshake Handshake Response Response Encrypted Encrypted message message Encrypted Encrypted message message Session ID X != Session ID Y
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Authentication / MITM «Bip151 provides excellent defence against government attackers with MITM capability: you can detect such attacks, and change behaviour. This is a huge improvement over the status quo of having no way of knowing if we’re being attacked.» Peter Todd
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Authentication? NO TOFU, no CA T RUST O N F IRST U SE C ertificate A uthorities
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 CA
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 SSH tofu ECDSA key fingerprint is SHA256:jkhd+oTybtJwDoMqPwLThFjgIZfO56IukmqMfN2TUq8. Are you sure you want to continue connecting (yes/no)?
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Make v2 faster and smaller !
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 V2 Message Structure
V1 vs V2 Message Structure V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 V1 12 bytes message command 4 bytes length 4 bytes double-SHA256 checksum 4 bytes net magic ? bytes payload ≥ 24 bytes … V2 1-13 bytes message command 3 bytes encrypted length ? bytes payload 16 bytes MAC (message authentication code) ≥ 20 bytes … …
V1 vs V2 Message Structure V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 V1 - message command string (pchCommand) The message command space is always 12 bytes examples: INV000000000 BLOCK0000000 V2 - message command string (or short id) First byte is size or short command id The threshold is 12 (<=12 it’s a length, >12 is a short id ) examples: 3INV 23 10GIGAMEGBLK
V1 vs V2 Message Structure V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Number Command Number Command ADDR GETHEADERS 13 21 14 BLOCK 22 HEADERS 15 BLOCKTXN 23 INV 16 CMPCTBLOCK 24 MERKLEBLOCK FEEFILTER NOTFOUND 17 25 GETADDR PING 18 26 19 GETBLOCKTXN 27 PONG 20 GETDATA 28 SENDCMPCT 21 GETHEADERS 29 SENDHEADERS HEADERS TX 22 30 23 INV 31 VERACK 30 TX 32 VERSION
V1 vs V2 Message Structure V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 V1 - INV (single) 12 bytes message command 4 bytes double-SHA256 checksum 4 bytes length 4 bytes net magic 37 bytes payload == 61 bytes V2 - INV (single) 37 bytes payload 16 bytes MAC (message authentication code) 3 bytes encrypted length 1 bytes message command short id == 57 bytes (93.4%)
V1 vs V2 Message Structure V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 V2 length field 3 bytes == 24 bits 23 bits for length + 1 rekey trigger bit Maximal Message length is 0x7FFFFF = ~8MB Longer messages (e.g. gigamegblocks) could use multi-part messages .
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Rekey ‣ Can be triggered by setting the most significant bit in the 3 bytes length field ‣ MUST not encrypt more then 1GB of data with the same key ‣ Avoid nonce reuse ‣ Rekey is SHA256(SHA256(session ID || old_symmetric_cipher_key))
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Custom AEAD construct: ChaCha20Poly1305 @Bitcoin stream cipher MAC
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 ChaCha20 ‣ Faster on systems without AES NI ‣ Not vulnerable to cache-timing attacks (ARX) ‣ randomly accessible output stream (parallelizable)
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 ChaCha20Poly1305 @Bitcoin ‣ Based on ChaCha20Poly1305@ OpenSSH which is. based on ChaCha20Poly1305 IETF RFC 7539
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 ChaCha20Poly1305 IETF RFC 7539 Change AD, Encrypt Length ChaCha20Poly1305 @OpenSSH More e ffi cient AD encryption ChaCha20Poly1305 @Bitcoin Optimized for bitcoins tra ffi c
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 ChaCha20Poly1305 @OpenSSH HandShake Key 2 Key 1 1 x ChaCha20 64 bytes 64bytes keystream 1x ChaCha20 Encrypt Length (4 bytes 32bytes for Poly1305 AD) key n x ChaCha20 Encrypt Payload …
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 ChaCha20Poly1305 @Bitcoin AD ChaCha20 round HandShake only on every 21 message Key 2 Key 1 1 x ChaCha20 64 bytes 64bytes keystream 1x ChaCha20 32bytes for Poly1305 Encrypt Length ( 3 bytes AD) at the calculated o ff site key n x ChaCha20 Use 3 byte AD instead of 4 Encrypt Payload …
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 ChaCha20Poly1305 @Bitcoin >= ~2.048 ChaCha20 „rounds“ per message ChaCha20Poly1305 @OpenSSH >= 3 ChaCha20 „rounds“ per message
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Bitcoin Core send message count with standard settings, random 24h addr 46’256 alert 2’611 block 133’753 blocktxn 493 cmpctblock 7’668 feefilter 3’892 getaddr 62 getblocktxn 11 getdata 235’692 getheaders 1’803 headers 8’576 inv 1’359’386 merkleblock 30’580 notfound 34’033 ping 88’239 pong 358’283 sendcmpct 7’077 sendheaders 3’984 tx 616’688 verack 7’191 version 7’215 0 350000 700000 1050000 1400000 number of messages
V2 MESSAGE TRANSPORT PROTOCOL Jonas Schnelli - Breaking Bitcoin 2019 Bitcoin Core send message bytes with standard settings, random 24h addr 43’889’156 alert 438’648 block 28’385’105’107 blocktxn 103’052’213 cmpctblock 111’999’152 feefilter 31’136 getaddr 0 getblocktxn 413 getdata 14’454’648 getheaders 1’843’575 headers 70’963’994 inv 621’129’068 merkleblock 4’509’778 notfound 2’657’783 ping 695’608 pong 2’866’264 sendcmpct 63’693 sendheaders 0 tx 329’581’872 verack 0 version 743’145 0 7500000000 15000000000 22500000000 30000000000 Bytes
Recommend
More recommend
