diff --git a/_guides/protocol.md b/_guides/protocol.md index e4e8eb5..367907f 100644 --- a/_guides/protocol.md +++ b/_guides/protocol.md @@ -251,40 +251,12 @@ verify the authenticity of messages before relaying them to peers. ### Transport Encryption & Privacy -Connections between peers in the Radicle network are encrypted using a [Noise][noise] -protocol handshake. This begins with two peers performing a [Diffie-Hellman][ecdh] key -exchange to agree on a shared session key that is used for the duration -of the connection. +> ⚠️ +> +> Because of a severe [security vulnerability in the network protocol][vuln], +> this section was removed. It will be updated once there is a resolution. -Radicle uses the [XK][noise-xk] handshake pattern, which requires the -connection responder's *static key* to be known in advance by the initiator. -This *pre-sharing* takes place over the gossip network via the -`NodeAnnouncement` message, since the static key is simply the Node ID. - - - -
- -
- -Once the static key is known, a connection to the node can be initiated -securely, by generating an ephemeral key from the static key, using -Diffie-Hellman. The last step involves the initiating node sending its own -static key over the secure channel. - -
- -
- -After the handshake phase is completed, all data exchanged between peers is -fully encrypted and benefits from strong [forward secrecy][fs], ensuring -secure and private communications across the network. - -> **Tip**: Radicle also supports [Tor] addresses. Users can leverage Tor to -> hide their IP address from peers, and connect to `.onion` addresses on the -> Tor network. +[vuln]: {% post_url 2026-09-23-disclosure-of-vulnerability-in-network-protocol %} ### Replication via Git