by merging it with the version packet. Or more accurately, by merging
it with the first packet sent after garbage termination, which may be
a decoy packet or the version packet.
The new protocol simplifies implementations:
- A protocol state machine won't need separate states for garbage
authentication and version phases.
- The special case of "ignoring the ignore bit" is removed.
- The freedom to choose the contents of the garbage authentication
packet is removed. This simplifies testing.
The reason for having a separate garbage authentication packet was
to materialize the separation of the key exchange phase and version
negotiation phase even in the bytestream on the wire. However, this
is not necessary, and arguably, these phases are still properly
separated: Since the AEAD will ensure that AAD (=garbage) is checked
before looking at the contents (=version), the peers won't interpret
version data before having authenticated the garbage.
* Recommend a byte length for aux random data
* Clarify that with signature verification by default at the end of the signing algorithm, using public keys from untrusted sources is not an issue.
* A few editorial nits
- Separate nonce generation into getting a random byte string and converting it to a suitable scalar ...
- ... to make clear that the byte string can be generated differently.
- Make the warning a little bit more prominent and improve writing
This is supposed to supersede https://github.com/sipa/bips/pull/158.
I tried to say this carefully. I don't think that multiparty signing is in general broken with short hashes. For example the attack in #158 could be avoided by letting everybody not only commit to the nonce but also to the message. It's just that using a collision-resistant hash just eliminates the problem entirely...
- Separate nonce generation into getting a random byte string and converting it to a suitable scalar ...
- ... to make clear that the byte string can be generated differently.
- Make the warning a little bit more prominent and improve writing
This is supposed to supersede https://github.com/sipa/bips/pull/158.
I tried to say this carefully. I don't think that multiparty signing is in general broken with short hashes. For example the attack in #158 could be avoided by letting everybody not only commit to the nonce but also to the message. It's just that using a collision-resistant hash just eliminates the problem entirely...
Tim Ruffing