Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG]: Prevent peer public key spoofing in p2p #4065

Closed
Erigara opened this issue Nov 21, 2023 · 0 comments
Closed

[BUG]: Prevent peer public key spoofing in p2p #4065

Erigara opened this issue Nov 21, 2023 · 0 comments
Assignees
@Erigara @timofeevmd
Labels
Bug Something isn't working iroha2-dev The re-implementation of a BFT hyperledger in RUST QA-confirmed This bug is reproduced and needs a fix Security This issue asks for improved security

Comments

@Erigara
Copy link
Contributor

Erigara commented Nov 21, 2023

Atm during handshake peer blindly trust other side that it's owns private key for the public key sent during handshake.

This should be fixed, probably by sending some kind of signature to other side to prove ownership of private key.

Relevant code: p2p/src/peer.rs GetKey and SendKey.
@Erigara Erigara added Bug Something isn't working Security This issue asks for improved security labels Nov 21, 2023
@Erigara Erigara self-assigned this Nov 21, 2023
@Erigara Erigara added the iroha2-dev The re-implementation of a BFT hyperledger in RUST label Nov 21, 2023
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
31b122f 
Signed-off-by: Shanin Roman <[email protected]>
@Erigara Erigara mentioned this issue Nov 22, 2023
Merged
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
e733eea 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
4caca27 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
49f06ab 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
0fa25ce 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
37eed69 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
177f8cd 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit that referenced this issue Nov 22, 2023
@Erigara
[fix] #4065: Prevent pub key spoofing in p2p
8588ca5 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit to Erigara/iroha that referenced this issue Nov 22, 2023
@Erigara
[fix] hyperledger-iroha#4065: Prevent pub key spoofing in p2p
30063f0 
Signed-off-by: Shanin Roman <[email protected]>
Erigara added a commit that referenced this issue Nov 22, 2023
@Erigara
[fix] #4065: Prevent pub key spoofing in p2p
395a578 
Signed-off-by: Shanin Roman <[email protected]>
@timofeevmd timofeevmd self-assigned this Dec 7, 2023
@timofeevmd timofeevmd added the QA-confirmed This bug is reproduced and needs a fix label Dec 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Erigara Erigara

@timofeevmd timofeevmd

Labels
Bug Something isn't working iroha2-dev The re-implementation of a BFT hyperledger in RUST QA-confirmed This bug is reproduced and needs a fix Security This issue asks for improved security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Erigara @timofeevmd