📅 Original date posted:2023-09-08
🗒️ Summary of this message: A proposal suggests using runes managed by a hardware wallet to authenticate RPC calls, preventing compromised clients from making unauthorized calls.
📝 Original message:
Very interesting proposal, though as Will points out we could implement the
same using runes: have the rune be managed by the hardware wallet, and
commit the rune used to authenticate the RPC call commit to the call's
payload. That way a potentially compromised client cannot authenticate
arbitrary calls, since the hardware wallet is required to associate a rune
with it, giving it a chance for review.
This is similar to how authentication of RPC calls works in greenlight,
where the node host is not trusted, and we need to pass the authenticated
commands forward to the signer for verification before processing any
signature request from the node. We chose to authenticate the payload
rather than the transport (which is what partonnere does) because it
removes the need for a direct connection, and adds flexibility to how we
can deliver the commands. Functionally they are very similar however.
Cheers,
Christian
On Thu, Sep 7, 2023, 15:06 Bastien TEINTURIER <bastien at acinq.fr> wrote:
> Hi William,
>
> > What is wrong with runes/macaroons for validating and authenticating
> > commands?
>
> Runes/macaroons don't provide any protection if the machine you are
> issuing the RPCs from is compromised. The attacker can change the
> parameters of your RPC call and your lightning node will still gladly
> execute it.
>
> > I can't imagine validating every RPC request with a hardware
> > device and trusted display, unless you have some specific use case in
> > mind.
>
> I think that this is because you have the wrong idea of which RPCs
> this is supposed to protect. This is useful for the RPCs that actually
> involve paying something (channel open, channel close, pay invoice).
> This isn't useful for "read" RPCs (listing channels).
>
> Making an on-chain operation or paying an invoice is something that is
> infrequent enough for the vast majority of nodes that it makes sense
> to validate it manually. Also, this is fully configurable: you can
> choose which RPCs you want to protect that way and which RPCs you want
> to keep open.
>
> Thanks,
> Bastien
>
> Le mer. 6 sept. 2023 à 17:42, William Casarin <jb55 at jb55.com> a écrit :
> >
> > On Wed, Sep 06, 2023 at 03:32:50AM +0200, Bastien TEINTURIER wrote:
> > >Hey Zman,
> > >
> > >I saw the announcement about the commando plugin, and it was actually
> > >one of the reasons I wanted to write up what I had in mind, because
> > >while commando also uses a lightning connection to send commands to a
> > >lightning node, it was missing what in my opinion is the most important
> > >part: having all of Bolt 8 handled by the HSM and validating commands
> > >using a trusted display.
> >
> > What is wrong with runes/macaroons for validating and authenticating
> > commands? I can't imagine validating every RPC request with a hardware
> > device and trusted display, unless you have some specific use case in
> > mind.
> >
> > Will
> _______________________________________________
> Lightning-dev mailing list
> Lightning-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20230908/57a116fe/attachment-0001.html>;
Christian Decker [ARCHIVE] /
npub1wt…gtuyn
2023-09-12 08:59:58
in reply to nevent1q…396a
Author Public Key
npub1wtx5qvewc7pd6znlvwktq03mdld05mv3h5dkzfwd3dc30gdmsptsugtuynPublished at
2023-09-12 08:59:58Event JSON
{
"id": "f6c75e06b822ec980cd8da0c78216b49db77f32e530b500ee0d433ac6502bcdc",
"pubkey": "72cd40332ec782dd0a7f63acb03e3b6fdafa6d91bd1b6125cd8b7117a1bb8057",
"created_at": 1694509198,
"kind": 1,
"tags": [
[
"e",
"a9e03a18a3a98b8c99b8e539d8b45eea1dd49ad05580430dd081544b51147e85",
"",
"root"
],
[
"e",
"2b17df283f80c2ac09af295d89ce8db4697d8a628456f66ed9cc045ee0c97a4a",
"",
"reply"
],
[
"p",
"f26569a10f83f6935797b8b53a87974fdcc1de6abd31e3b1a3a19bdaed8031cb"
]
],
"content": "📅 Original date posted:2023-09-08\n🗒️ Summary of this message: A proposal suggests using runes managed by a hardware wallet to authenticate RPC calls, preventing compromised clients from making unauthorized calls.\n📝 Original message:\nVery interesting proposal, though as Will points out we could implement the\nsame using runes: have the rune be managed by the hardware wallet, and\ncommit the rune used to authenticate the RPC call commit to the call's\npayload. That way a potentially compromised client cannot authenticate\narbitrary calls, since the hardware wallet is required to associate a rune\nwith it, giving it a chance for review.\n\nThis is similar to how authentication of RPC calls works in greenlight,\nwhere the node host is not trusted, and we need to pass the authenticated\ncommands forward to the signer for verification before processing any\nsignature request from the node. We chose to authenticate the payload\nrather than the transport (which is what partonnere does) because it\nremoves the need for a direct connection, and adds flexibility to how we\ncan deliver the commands. Functionally they are very similar however.\n\nCheers,\nChristian\n\nOn Thu, Sep 7, 2023, 15:06 Bastien TEINTURIER \u003cbastien at acinq.fr\u003e wrote:\n\n\u003e Hi William,\n\u003e\n\u003e \u003e What is wrong with runes/macaroons for validating and authenticating\n\u003e \u003e commands?\n\u003e\n\u003e Runes/macaroons don't provide any protection if the machine you are\n\u003e issuing the RPCs from is compromised. The attacker can change the\n\u003e parameters of your RPC call and your lightning node will still gladly\n\u003e execute it.\n\u003e\n\u003e \u003e I can't imagine validating every RPC request with a hardware\n\u003e \u003e device and trusted display, unless you have some specific use case in\n\u003e \u003e mind.\n\u003e\n\u003e I think that this is because you have the wrong idea of which RPCs\n\u003e this is supposed to protect. This is useful for the RPCs that actually\n\u003e involve paying something (channel open, channel close, pay invoice).\n\u003e This isn't useful for \"read\" RPCs (listing channels).\n\u003e\n\u003e Making an on-chain operation or paying an invoice is something that is\n\u003e infrequent enough for the vast majority of nodes that it makes sense\n\u003e to validate it manually. Also, this is fully configurable: you can\n\u003e choose which RPCs you want to protect that way and which RPCs you want\n\u003e to keep open.\n\u003e\n\u003e Thanks,\n\u003e Bastien\n\u003e\n\u003e Le mer. 6 sept. 2023 à 17:42, William Casarin \u003cjb55 at jb55.com\u003e a écrit :\n\u003e \u003e\n\u003e \u003e On Wed, Sep 06, 2023 at 03:32:50AM +0200, Bastien TEINTURIER wrote:\n\u003e \u003e \u003eHey Zman,\n\u003e \u003e \u003e\n\u003e \u003e \u003eI saw the announcement about the commando plugin, and it was actually\n\u003e \u003e \u003eone of the reasons I wanted to write up what I had in mind, because\n\u003e \u003e \u003ewhile commando also uses a lightning connection to send commands to a\n\u003e \u003e \u003elightning node, it was missing what in my opinion is the most important\n\u003e \u003e \u003epart: having all of Bolt 8 handled by the HSM and validating commands\n\u003e \u003e \u003eusing a trusted display.\n\u003e \u003e\n\u003e \u003e What is wrong with runes/macaroons for validating and authenticating\n\u003e \u003e commands? I can't imagine validating every RPC request with a hardware\n\u003e \u003e device and trusted display, unless you have some specific use case in\n\u003e \u003e mind.\n\u003e \u003e\n\u003e \u003e Will\n\u003e _______________________________________________\n\u003e Lightning-dev mailing list\n\u003e Lightning-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20230908/57a116fe/attachment-0001.html\u003e",
"sig": "a2ab7151f083a040d002a97bea3d83644bce539d992b9ec7451df9f6f93e0a43758b2d53690770c5b2990a3a6462fc12ee9ccf4d5e76f8275d93a08b0e73d7e8"
}