- HMAC-MD5(payload || IV || (payloadLength ^ protocolVersion), macKey) + HMAC-MD5(encryptedPayload + IV + (payloadLength ^ protocolVersion), macKey)-where '||' means append. -The payload is the message starting with the flag byte. +where '+' means append and '^' means exclusive-or. +
+The IV is generated randomly for each packet.
+The encryptedPayload is the encrypted version of the message starting with the flag byte (encrypt-then-MAC).
+The payloadLength used in the MAC is a 2 byte unsigned integer.
+Note that protocolVersion is 0, so the exclusive-or is a no-op.
The macKey is either the introduction key or is constructed from the
exchanged DH key (see details below), as specified for each message below.
-Note that protocolVersion is 0, so the exclusive or is a no-op.
WARNING - the HMAC-MD5-128 used here is non-standard,
see the cryptography page for details.
@@ -41,14 +44,38 @@ see the cryptography page<
The payload itself (that is, the message starting with the flag byte)
is AES256/CBC encrypted with the IV and the
sessionKey, with replay prevention addressed within its body,
-explained below. The payloadLength in the MAC is a 2 byte unsigned
-integer.
The protocolVersion is a 2 byte unsigned integer and is currently set to 0. Peers using a different protocol version will not be able to communicate with this peer, though earlier versions not using this flag are.
+
+
{% trans %}Legend:{% endtrans %}
X, Y: {% trans %}256 byte DH public keys{% endtrans %}
H(): 32 byte SHA256 Hash
@@ -163,7 +164,7 @@ Alice sends Bob:
{% trans %}Size:{% endtrans %} 288 bytes
{% endhighlight %}
{% trans %}Contents:{% endtrans %}
-{% highlight %}
+{% highlight lang='dataspec' %}
+----+----+----+----+----+----+----+----+
| X, as calculated from DH |
+ +
@@ -182,6 +183,7 @@ Alice sends Bob:
{% endhighlight %}
+
X: {% trans %}256 byte X from Diffie Hellman{% endtrans %}
HXxorHI: {% trans commonstructures=site_url('docs/spec/common-structures') -%}
@@ -231,6 +233,7 @@ This is the DH reply. Bob sends Alice:
{% endhighlight %}
+
Y: {% trans %}256 byte Y from Diffie Hellman{% endtrans %}
HXY: {% trans %}SHA256 Hash(X concatenated with Y){% endtrans %}
@@ -243,7 +246,7 @@ This is the DH reply. Bob sends Alice:
{% trans %}Encrypted Contents:{% endtrans %}
-{% highlight %}
+{% highlight lang='dataspec' %}
+----+----+----+----+----+----+----+----+
| Y as calculated from DH |
+ +
@@ -266,6 +269,7 @@ This is the DH reply. Bob sends Alice:
{% endhighlight %}
+
Y: {% trans %}256 byte Y from Diffie Hellman{% endtrans %}
encrypted data: {% trans cryptography=site_url('docs/how/cryptography') -%}
@@ -291,7 +295,7 @@ This contains Alice's router identity, and a DSA signature of the critical data.
{% trans %}Size:{% endtrans %} 448 bytes (typ. for 387 byte identity)
{% endhighlight %}
{% trans %}Unencrypted Contents:{% endtrans %}
-{% highlight %}
+{% highlight lang='dataspec' %}
+----+----+----+----+----+----+----+----+
| sz | Alice's Router Identity |
+----+----+ +
@@ -318,6 +322,7 @@ This contains Alice's router identity, and a DSA signature of the critical data.
{% endhighlight %}
+
sz: {% trans %}2 byte size of Alice's router identity to follow (should always be 387){% endtrans %}
ident: {% trans commonstructures=site_url('docs/spec/common-structures') -%}
@@ -337,7 +342,7 @@ the 40 byte DSA signature of
{% trans %}Encrypted Contents:{% endtrans %}
-{% highlight %}
+{% highlight lang='dataspec' %}
+----+----+----+----+----+----+----+----+
| |
+ +
@@ -348,6 +353,7 @@ the 40 byte DSA signature of
{% endhighlight %}
+
encrypted data: {% trans cryptography=site_url('docs/how/cryptography') -%}
448 bytes AES encrypted using the DH session key and
the last 16 bytes of HXxorHI (i.e., the last 16 bytes of message #1) as the IV
@@ -381,7 +387,7 @@ This is a DSA signature of the critical data. Bob sends Alice:
{% trans %}Size:{% endtrans %} 48 bytes
{% endhighlight %}
{% trans %}Unencrypted Contents:{% endtrans %}
-{% highlight %}
+{% highlight lang='dataspec' %}
+----+----+----+----+----+----+----+----+
| |
+ +
@@ -398,6 +404,7 @@ This is a DSA signature of the critical data. Bob sends Alice:
{% endhighlight %}
+
signature: {% trans commonstructures=site_url('docs/spec/common-structures') -%}
the 40 byte DSA signature of the following concatenated data:
X, Y, Alice's Router Identity, tsA, tsB.
@@ -410,7 +417,7 @@ the 40 byte DSA signature of
{% trans %}Encrypted Contents:{% endtrans %}
-{% highlight %}
+{% highlight lang='dataspec' %}
+----+----+----+----+----+----+----+----+
| |
+ +
@@ -421,6 +428,7 @@ the 40 byte DSA signature of
{% endhighlight %}
+
encrypted data: {% trans cryptography=site_url('docs/how/cryptography') -%}
48 bytes AES encrypted using the DH session key and
the last 16 bytes of the encrypted contents of message #2 as the IV