radicle/radicle.xyz
1
0
Fork 0
mirror of https://seed.radicle.dev/rad:z371PVmDHdjJucejRoRYJcDEvD5pp.git synced 2026-10-18 19:10:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

guides/protocol: Remove "Encryption and Privacy"

Browse Source
This commit is contained in:
Yorgos Saslis
2026-10-05 15:54:17 +02:00
committed by Lorenz Leutgeb
parent 8780e419de
commit 20d41d6e9a
1 changed files with 5 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
_guides/protocol.md
+5 -33
View File
@@ -251,40 +251,12 @@ verify the authenticity of messages before relaying them to peers.
### Transport Encryption & Privacy
Connections between peers in the Radicle network are encrypted using a [Noise][noise]
protocol handshake. This begins with two peers performing a [Diffie-Hellman][ecdh] key
exchange to agree on a shared session key that is used for the duration
of the connection.
> ⚠️
>
> Because of a severe [security vulnerability in the network protocol][vuln],
> this section was removed. It will be updated once there is a resolution.
Radicle uses the [XK][noise-xk] handshake pattern, which requires the
connection responder's *static key* to be known in advance by the initiator.
This *pre-sharing* takes place over the gossip network via the
`NodeAnnouncement` message, since the static key is simply the Node ID.
<aside> The Noise framework calls the node that is receiving an inbound
connection the <em>responder</em>, and the node that is initiating the
connection the <em>initiator</em>. </aside>
<figure class="diagram">
<object type="image/svg+xml" data="/assets/images/noisexk-1.svg"></object>
</figure>
Once the static key is known, a connection to the node can be initiated
securely, by generating an ephemeral key from the static key, using
Diffie-Hellman. The last step involves the initiating node sending its own
static key over the secure channel.
<figure class="diagram">
<object type="image/svg+xml" data="/assets/images/noisexk-2.svg"></object>
</figure>
After the handshake phase is completed, all data exchanged between peers is
fully encrypted and benefits from strong [forward secrecy][fs], ensuring
secure and private communications across the network.
> **Tip**: Radicle also supports [Tor] addresses. Users can leverage Tor to
> hide their IP address from peers, and connect to `.onion` addresses on the
> Tor network.
[vuln]: {% post_url 2026-09-23-disclosure-of-vulnerability-in-network-protocol %}
### Replication via Git