Repository navigation
Conversation
All subnets share the same relays and setup seed, so a client's signed round messages were valid on every subnet. A relay leading one subnet could replay a client's round into another subnet in the same round and link the client to its payload through the two client sets. The session id is now derived from a per-subnet scope, and every client signature covers the session id. Relays verify the client's post signature before admitting it, so a replayed or forged post can no longer take an admission slot.
Client contributions now carry a signature over the subnet and a digest of the message, checked by the leader, aggregators, and scheduled relays. Single-round ADCNet also derives its blinding keys per subnet, so a contribution forwarded by a dishonest aggregator still does not decode on another subnet. Adds an end-to-end test where a relay forwards contributions between two subnets' leaders and the payload must be delivered only once.
There was a problem hiding this comment.
🟡 Changes recommended
Aggregated-round replay remains possible through unscoped relay shares, and Panetiere still consumes admission capacity before validating inner posts.
2 open issues
What changed in this PR
This PR adds subnet-specific authentication to client messages across Panetiere and ADCNet to prevent cross-subnet replay. The wire-format and signature changes require a coordinated upgrade.
Changes:
- Bind Panetiere sessions and client signatures to the subnet.
- Add subnet-binding signatures to ADCNet client messages and per-subnet blinding keys to single-round ADCNet.
- Update session construction and add replay-rejection tests.
| File | Description |
|---|---|
crates/anymone-core/tests/session_scheduledadcnet.rs |
Supply subnet IDs in session tests. |
crates/anymone-core/tests/session_adcnet.rs |
Update ADCNet test constructors. |
crates/anymone-core/tests/session_adcnet_aggregated.rs |
Update client, relay, and aggregator constructors. |
crates/anymone-core/tests/scheduler_core.rs |
Supply subnet IDs in scheduler fixtures. |
crates/anymone-core/tests/adcnet_cross_subnet_replay.rs |
Add an end-to-end contribution replay test. |
crates/anymone-core/src/remote_session.rs |
Configure subnet scope for remote clients. |
crates/anymone-core/src/panetiere.rs |
Scope session IDs and client signatures; add rejection coverage. |
crates/anymone-core/src/panetiere_scheduled.rs |
Apply subnet scope to scheduled messages and reservations. |
crates/anymone-core/src/adcnet.rs |
Add client bindings, scoped blinding keys, and unit tests. |
Review effort: Balanced
| /// Blinding pads derive from the relays' ECDH secrets, which every subnet | ||
| /// shares; keying them per subnet keeps a contribution that is replayed into | ||
| /// another subnet from unblinding there. | ||
| fn subnet_shared_key(shared: &SharedKey, subnet: SubnetId) -> SharedKey { |
| signer, | ||
| &signature, | ||
| &client_public_signing_bytes(round, client_id, &entry), | ||
| &client_public_signing_bytes(&sid, client_id, &entry), |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every subnet has the same relays and the same setup seed, so a client's signed round messages were accepted on any subnet. A relay leading one subnet could replay a client's message into another subnet in the same round. Only that client would then appear in both subnets' client sets, which links the client to its payload. Since each relay is on every subet, it takes only one evil relay to deanonymize a member.
Panetiere and Scheduled Panetiere
ADCNet and Scheduled ADCNet
Tests
Breaking change: the wire format and signatures change, so all nodes and the mobile app must upgrade together.