Noise Protocols for Waku Payload Encryption #
- Status: raw
- Editor: Giuseppe email@example.com
This specification describes how payloads of Waku messages with version 2 can be encrypted in order to achieve confidentiality, authenticity, and integrity as well as some form of identity-hiding on communicating parties.
This specification extends the functionalities provided by 26/WAKU-PAYLOAD, adding support to modern symmetric encryption primitives and asymmetric key-exchange protocols.
Specifically, it adds support to the
ChaChaPoly cipher for symmetric authenticated encryption.
It further describes how the Noise Protocol Framework can be used to exchange cryptographic keys and encrypt/decrypt messages
in a way that the latter are authenticated and protected by strong forward secrecy.
This ultimately allows Waku applications to instantiate end-to-end encrypted communication channels with strong conversational security guarantees, as similarly done by 5/SECURE-TRANSPORT but in a more modular way, adapting key-exchange protocols to the knowledge communicating parties have of each other.
Design requirements #
- Confidentiality: the adversary should not be able to learn what data is being sent from one Waku endpoint to one or several other Waku endpoints.
- Strong forward secrecy: an active adversary cannot decrypt messages nor infer any information on the employed encryption key, even in the case he has access to communicating parties’ long-term private keys (during or after their communication).
- Authenticity: the adversary should not be able to cause a Waku endpoint to accept messages coming from an endpoint different than their original senders.
- Integrity: the adversary should not be able to cause a Waku endpoint to accept data that has been tampered with.
- Identity-hiding: once a secure communication channel is established, a passive adversary should not be able to link exchanged encrypted messages to their corresponding sender and recipient.
Supported Cryptographic Protocols #
Noise Protocols #
Two parties executing a Noise protocol exchange one or more handshake messages and/or transport messages. A Noise protocol consists of one or more Noise handshakes. During a Noise handshake, two parties exchange multiple handshake messages. A handshake message contains ephemeral keys and/or static keys from one of the parties and an encrypted or unencrypted payload that can be used to transmit optional data. These public keys are used to perform a protocol-dependent sequence of Diffie-Hellman operations, whose results are all hashed into a shared secret key. After a handshake is complete, each party will then use the derived shared secret key to send and receive authenticated encrypted transport messages. We refer to Noise protocol framework specifications for the full details on how parties shared secret key is derived from each exchanged message.
Four Noise handshakes are currently supported:
XXpsk0. Their description can be found in Appendix: Supported Handshakes Description.
These are instantiated combining the following cryptographic primitives:
Curve25519for Diffie-Hellman key-exchanges (32 bytes curve coordinates);
ChaChaPolyfor symmetric authenticated encryption (16 bytes authentication tag);
SHA256hash function used in
HKDFkeys derivation chains (32 bytes output size);
Content Topics and Message Nametags of Noise Handshake Messages #
We note that all design requirements on exchanged messages would be satisfied only after a supported Noise handshake is completed,
corresponding to a total of 1 Round Trip Time communication (1-RTT).
In particular, identity-hiding properties can be guaranteed only if the recommendation described in After-handshake are implemented.
In the following, we assume that communicating parties reciprocally know an initial
where they can send/receive the first handshake message(s).
We further assume that messages sent over a certain
contentTopic can be efficiently identified by their intended recipients
thanks to an arbitrary 16 bytes long
message-nametag field embedded in the message payload
which is known in advance before messages reception.
The second handshake message MAY be sent/received with a
message-nametag deterministically derived from the handshake state obtained after processing the first handshake message
(using, for example,
HKDF over the handshake hash value
- the recipient to efficiently continue the handshakes started by each initiator;
- the initiators to efficiently associate the recipient’s second handshake message to their first handshake message, However, this does not provide any identity-hiding guarantee to the recipient.
After the second handshake message is correctly received by initiators, the recommendation described in After-handshake SHOULD be implemented to provide full identity-hiding guarantees for both initiator and recipient against passive attackers.
Encryption Primitives #
The symmetric primitives supported are:
ChaChaPolyfor authenticated encryption (16 bytes authentication tag).
When 14/WAKU-MESSAGE version is set to 2,
payload will encapsulate the two fields
handshake-message field MAY contain
- a Noise handhshake message (only encrypted/unencrypted public keys).
transport-message field MAY contain
- a Noise handshake message payload (encrypted/unencrypted);
- a Noise transport message;
transport-message encodes a
ChaChaPoly ciphertext, the corresponding
handshake-message field MUST be empty.
The following fields are concatenated to form the
message-nametag: an arbitrary identifier for the Waku message (16 byte). If the underlying encryption primitive supports it, the contents of this field SHOULD be passed as additional data to the encryption and decryption routines.
protocol-id: identifies the protocol or primitive in use (1 byte). Supported values are:
0: protocol specification omitted (set for after-handshake messages);
10: Noise protocol
11: Noise protocol
12: Noise protocol
13: Noise protocol
handshake-message-len: the length in bytes of the Noise handshake message (1 byte). If
protocol-idis not equal to
13, this field MUST be set to
handshake-message: the Noise handshake message (
0, it contains the concatenation of one or more Noise Diffie-Hellman ephemeral or static keys encoded as in Public Keys Encoding;
transport-message-len: the length in bytes of
transport-message(8 bytes, stored in Little-Endian);
transport-message: the transport message (
transport-message-lenbytes); Only during a Noise handshake, this field would contain the Noise handshake message payload. The symmetric encryption authentication data for
transport-message, when present, is appended at the end of
Using Augmented Backus-Naur form (ABNF) we have the following format:
; message nametag message-nametag = 16OCTET ; protocol ID protocol-id = 1OCTET ; contains the size of handshake-message handshake-message-len = 1OCTET ; contains one or more Diffie-Hellman public keys handshake-message = *OCTET ; contains the size of transport-message transport-message-len = *OCTET ; contains the transport message, eventually encrypted. ; If encrypted, authentication data is appended transport-message = *OCTET ; the Waku WakuMessage payload field payload = message-nametag protocol-id handshake-message-len handshake-message transport-message-len transport-message
Protocol Payload Format #
Based on the specified
the Waku message
payload field will encode different types of protocol-dependent messages.
In particular, if
0: payload encodes an after-handshake message.
handshake-message-lenMAY be 0;
transport-messagecontains the Noise transport message;
13: payload encodes a supported Noise handshake message.
transport-messagecontains the Noise transport message;
30: payload encapsulate a
handshake-message-lenis set to
transport-messagecontains the concatenation of the encryption nonce (12 bytes) followed by the ciphertext
ctand the authentication data for
transport-message-lenis set accordingly to
Public Keys Serialization #
Diffie-Hellman public keys can be trasmitted in clear
or in encrypted form (cf.
WriteMessage) with authentication data attached.
To distinguish between these two cases, public keys are serialized as the concatenation of the following three fields:
flag: is equal to
1if the public key is encrypted;
0otherwise (1 byte);
flag = 0, it contains an encoding of the X coordinate of the public key. If
flag = 1, it contains a symmetric encryption of an encoding of the X coordinate of the public key, followed by encryption’s authentication data;
The corresponding serialization is obtained as
As regards the underlying supported cryptographic primitives:
Curve25519public keys X coordinates are encoded in little-endian as 32 bytes arrays;
ChaChaPolyauthentication data consists of 16 bytes (nonces are implicitely defined by Noise processing rules).
In all supported Noise protocols,
parties’ static public keys are transmitted encrypted (cf.
while ephemeral keys MAY be encrypted after a handshake is complete.
To prevent some metadata leakage, encrypted transport messages SHOULD be padded before encryption.
It is therefore recommended to right pad transport messages using RFC2630 so that their final length is a multiple of 248 bytes.
During the initial 1-RTT communication,
handshake messages might be linked,
depending on the
message-nametag derivation rule implemented,
to the respective parties through the
message-nametag fields employed for such communication.
After a handshake is completed,
parties MAY derive from their shared secret key (preferably using
nametag-secret-inbound values used to deterministically derive
two arbitrary-long ordered lists of
used to indentify outbound and inbound messages, respectively
message-nametag MAY be computed as
HKDF(nametag-secret-inbound || n)).
This allows communicating parties to efficiently identify messages addressed to them sent over a certain
and thus minimize the number of trial decryptions.
parties SHOULD set
to reduce metadata leakages and indicate that the message is an after-handshake message.
Each party SHOULD attach an (unencrypted) ephemeral key in
handshake-message to every message sent.
According to Noise processing rules,
this allows updates to the shared secret key
by hashing the result of an ephemeral-ephemeral Diffie-Hellman exchange every 1-RTT communication.
Backward Support for Symmetric/Asymmetric Encryption #
It is possible to have backward compatibility to symmetric/asymmetric encryption primitives from 26/WAKU-PAYLOAD, effectively encapsulating payload encryption 14/WAKU-MESSAGE version 1 in version 2.
It suffices to extend the list of supported
254: AES-256-GCM symmetric encryption;
255: ECIES asymmetric encryption.
and set the
transport-message field to the 26/WAKU-PAYLOAD
data field, whenever these
protocol-id values are set.
protocol-id = 254, 255 then:
message-nametag: is empty;
handshake-message-len: is set to
handshake-message: is empty;
transport-message: contains the 26/WAKU-PAYLOAD
datafield (AES-256-GCM or ECIES, depending on
transport-message-lenis set accordingly to
transport-message corresponding to
protocol-id = 254, 255 is retrieved,
it SHOULD be decoded as the
data field in 26/WAKU-PAYLOAD specification.
Appendix: Supported Handshakes Description #
Supported Noise handshakes address four typical scenarios occurring when an encrypted communication channel between Alice and Bob is going to be created:
- Alice and Bob know each others’ static key.
- Alice knows Bob’s static key;
- Alice and Bob share no key material and they don’t know each others’ static key.
- Alice and Bob share some key material, but they don’t know each others’ static key.
Adversarial Model: an active attacker who compromised one party’s static key may lower the identity-hiding security guarantees provided by some handshakes. In our security model we exclude such adversary, but for completeness we report a summary of possible de-anonymization attacks that can be performed by an active attacker.
If Alice and Bob know each others’ static key (e.g., these are public or were already exchanged in a previous handshake) , they MAY execute a
K1K1 handshake. Using Noise notation (Alice is on the left) this can be sketched as:
K1K1: -> s <- s ... -> e <- e, ee, es -> se
We note that here only ephemeral keys are exchanged. This handshake is useful in case Alice needs to instantiate a new separate encrypted communication channel with Bob, e.g. opening multiple parallel connections, file transfers, etc.
Security considerations on identity-hiding (active attacker): no static key is transmitted, but an active attacker impersonating Alice can check candidates for Bob’s static key.
Here, Alice knows how to initiate a communication with Bob and she knows his public static key: such discovery can be achieved, for example, through a publicly accessible register of users’ static keys, smart contracts, or through a previous public/private advertisement of Bob’s static key.
A Noise handshake pattern that suits this scenario is
XK1: <- s ... -> e <- e, ee, es -> s, se
Within this handshake, Alice and Bob reciprocally authenticate their static keys
s using ephemeral keys
e. We note that while Bob’s static key is assumed to be known to Alice (and hence is not transmitted), Alice’s static key is sent to Bob encrypted with a key derived from both parties ephemeral keys and Bob’s static key.
Security considerations on identity-hiding (active attacker): Alice’s static key is encrypted with forward secrecy to an authenticated party. An active attacker initiating the handshake can check candidates for Bob’s static key against recorded/accepted exchanged handshake messages.
If Alice is not aware of any static key belonging to Bob (and neither Bob knows anything about Alice), she can execute an
XX handshake, where each party tranXmits to the other its own static key.
The handshake goes as follows:
XX: -> e <- e, ee, s, es -> s, se
We note that the main difference with
XK1 is that in second step Bob sends to Alice his own static key encrypted with a key obtained from an ephemeral-ephemeral Diffie-Hellman exchange.
This handshake can be slightly changed in case both Alice and Bob pre-shares some secret
psk which can be used to strengthen their mutual authentication during the handshake execution. One of the resulting protocol, called
XXpsk0, goes as follow:
XXpsk0: -> psk, e <- e, ee, s, es -> s, se
The main difference with
XX is that Alice’s and Bob’s static keys, when transmitted, would be encrypted with a key derived from
psk as well.
Security considerations on identity-hiding (active attacker): Alice’s static key is encrypted with forward secrecy to an authenticated party for both
XXpsk0 handshakes. In
XX, Bob’s static key is encrypted with forward secrecy but is transmitted to a non-authenticated user which can then be an active attacker. In
XXpsk0, instead, Bob’s secret key is protected by forward secrecy to a partially authenticated party (through the pre-shared secret
psk but not through any static key), provided that
psk was not previously compromised (in such case identity-hiding properties provided by the
XX handshake applies).
- Noise protocol
- Noise handshakes as key-exchange mechanism for Waku2
- Augmented Backus-Naur form (ABNF)
- RFC2630 - Content-encryption Process and padding
Copyright and related rights waived via CC0.