Randomize initial onion packet data. by TheBlueMatt · Pull Request #403 · lightningdevkit/rust-lightning

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt · 2019-11-25T21:20:41Z

This avoids at least the trivial hop count discovery attack, though
other obvious ones remain and are slightly harder to avoid.

See lightning/bolts#697

ariard · 2019-11-29T07:02:59Z

Okay would go tomorrow through the whole issue+ml announcement to double-check the fix is right.

ariard

From the paper : "The exit node hence can learn the length of the chosen path
with the following attack: The adversarial exit node observes
(after XORing) where the first 1 bit after the identifier is.
It knows that the filler string starts there or earlier and can
determine by the length of the filler string a lower bound on
the length of the path used."

If I understand correctly the heuristic lies on given a filler starting in the packet, I can deduce the previous size allocated for message headers (in LN the hops_payload), but assuming message headers size is known (at least in v0 onion) isn't the whole length of the path leaked ?

ariard · 2019-11-30T04:29:26Z

 self.offset = 0;
 }

+ #[inline] // Useful cause input may be 0s on stack that should be optimized out


A warn against too smart compiler which would align stack after function jump?

Hmm? Not sure what you're asking.

Wasn't asking anything, just wanted to be sure that inline was to prevent compiler alignement.

Not sure what you mean by "alignment", but, in any case, afaiu, #[inline] has two meanings:
for pub fns it allows inlining across crates, which is normally only possible with lto,
for regular fns its just a hint to the compiler that it should try inlining, which it is free to completely ignore if it likes.

This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

ariard · 2019-12-03T05:45:21Z

ACK fd1d5fd, that's okay for now but let's not abuse conditional compilation for testing.

TheBlueMatt · 2019-12-03T19:37:30Z

Ehh, we do it in a number of places already for fuzztarget, and exposing the onion data just for testing is grosser than just throwing test code in...

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 9714cb4 to 500a69aCompare November 25, 2019 21:20

TheBlueMatt mentioned this pull request Nov 28, 2019
Replace keys API with Signer API to support hardware wallets eventually #404
Merged

ariard reviewed Nov 30, 2019
View reviewed changes

Comment threadlightning/src/ln/onion_utils.rs Outdated

Randomize initial onion packet data.
fd1d5fd
This avoids at least the trivial hop count discovery attack, though other obvious ones remain and are slightly harder to avoid. See lightning/bolts#697

TheBlueMatt force-pushed the 2019-11-rand-onion branch from 56996b6 to fd1d5fdCompare December 2, 2019 00:22

TheBlueMatt merged commit 9f30b30 into lightningdevkit:masterDec 3, 2019

Uh oh!

Conversation

TheBlueMatt commented Nov 25, 2019

Uh oh!

ariard commented Nov 29, 2019

Uh oh!

ariard left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ariard commented Dec 3, 2019

Uh oh!

TheBlueMatt commented Dec 3, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

TheBlueMatt commented Nov 25, 2019

Uh oh!

ariard commented Nov 29, 2019

Uh oh!

ariard left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ariard commented Dec 3, 2019

Uh oh!

TheBlueMatt commented Dec 3, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

TheBlueMatt commented Nov 25, 2019

Uh oh!

ariard commented Nov 29, 2019

Uh oh!

ariard left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!