mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-10 00:26:59 +00:00
Johnathan Corgan
0155345984
The responder recorded a session under the source address carried in the datagram without ever checking that address against the static key the Noise handshake had just authenticated. A peer could therefore complete a genuine handshake while claiming another node's address, and the identity cache, the session map and the address the IPv6 shim reconstructs on delivery would all attribute its traffic to the node it named. Derive the address from the authenticated key at the point the key first becomes available in msg3, and reject the handshake when it does not match the claimed source. The entry has already been removed by that point, so returning drops the half-open session and neither the identity nor the session is recorded. The rekey responder path needed its own check rather than inheriting that one. It returns before the initial path's code is reached, and it never read the peer's static key at all, so a rekey could complete under an established session with a different key than the one that opened it. It now requires the key to be unchanged, which is the stronger comparison available there, and abandons the rekey while keeping the existing session intact on mismatch. Tearing the session down instead would have handed an attacker a way to kill established sessions. Both comparisons are on x-only keys. A stored peer key may carry a synthesized even parity because npubs encode no parity, while the handshake learns the true point, so comparing full keys would reject roughly half of legitimate peers on every rekey. Both rejections are counted separately in the session reject statistics. The tests drive real Noise handshakes through the datagram entry point and construct the mismatch rather than asserting the comparison exists.