Skip to content

Commit

Permalink
EIP-8: clarification clarifications
Browse files Browse the repository at this point in the history
  • Loading branch information
fjl committed Feb 2, 2016
1 parent 48e68ea commit dea91fc
Showing 1 changed file with 14 additions and 13 deletions.
27 changes: 14 additions & 13 deletions EIPS/eip-8.md
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@ version simply send a packet with higher version and possibly additional list el
#### Changes to the RLPx Discovery Protocol

The relaxation of discovery packet decoding rules largely codifies current practice. Most
existing clients do not care about the number of list elements (a notable exception being
existing implementations do not care about the number of list elements (an exception being
go-ethereum) and do not reject nodes with mismatching version. This behaviour is not
guaranteed by the spec, though.

Expand Down Expand Up @@ -160,21 +160,22 @@ if decrypt(packet) {
}
```

The plain text size prefix is perhaps the most controversial aspect of this document.
it has been argued that the prefix aids adversaries that seek to filter and identify
RLPx connections on the network level.
The plain text size prefix is perhaps the most controversial aspect of this document. It
has been argued that the prefix aids adversaries that seek to filter and identify RLPx

Whether this is an issue depends on the attacker's budget and the availability
of other indicators. If the recommendation to randomise the lengths is followed,
pure pattern-based packet recognition is unlikely to succeed.
connections on the network level.

This is largely a question of how much effort the adversary is willing to expense. If the
recommendation to randomise the lengths is followed, pure pattern-based packet
recognition is unlikely to succeed.

* For typical firewall operators, blocking all connections whose first two bytes form an
integer in range [300,600] is probably too invasive. Port-based blocking is likely to
be a more effective measure for filtering most RLPx traffic.
* For an attacker who can afford to correlate many criteria, the size prefix will ease
recognition because it adds to the indicator set. However, such an attacker can also be
expected to read and or participate in RLPx Discovery traffic, in which case effective
blocking is possible irrespective of the size prefix.
integer in range [300,600] is probably too invasive. Port-based blocking is likely to be
a more effective measure for filtering most RLPx traffic.
* For an attacker who can afford to correlate many criteria, the size prefix would ease
recognition because it adds to the indicator set. However, such an attacker could also
be expected to read or participate in RLPx Discovery traffic, which would be sufficient
to enable blocking of RLPx TCP connections whatever their format is.

### Backwards Compatibility

Expand Down

0 comments on commit dea91fc

Please sign in to comment.