Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RLPx AES CTR keystream reusage #1315 (SEC-50 ) : Case for private network #7926

Open
banquedefrance-blockchain opened this issue Nov 26, 2024 · 0 comments

Comments

@banquedefrance-blockchain

Hi, does Besu RLPx implementation solve this issue?
ethereum/go-ethereum#1315

In case of a private network, what are the potential impacts, if any?

from ethereum/devp2p#32 :
"The two sides of a RLPx connection generate two CTR streams from the same key, nonce and IV.
If an attacker knows one plaintext, he can decrypt unknown plaintexts of the reused keystream.
Separate keys needs to be used for each stream. See for example the TLS 1.2 RFC 5246 section 6.3."

In the case of a private network, here is a fix proposed for rlpx.go:

LaurentMT/go-ethereum@e8cba72

Regards,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant