Wouldn't that be insecure? Like a password you can't change?

Reply to this note

Please Login to reply.

Discussion

Pretty sure people buying accounts don't care that much.

It's totally insecure.

In the protocol I am working on at the moment, clients send out pairs of private keys to relays after making a payment over LN that has the preimage field being the hash of the two keys concatenated.

The key is also used to authenticate messages sent to the relay. The relay needs it to recognise the session for which it will decrement according to the amount of bytes/time the message requires. Only the relay itself recognises it, and the client is not a relay and it knows it as the session key it owns with a given relay.

Normally both parties have their own private keys, and send each other their public keys, and combining them together using Elliptic Curve Diffie Hellman, they can generate the same secret to use with symmetric encryption.

This protocol instead uses the key as a session identifier, and combines this with its use for encryption, and clients generate a separate private key, which they combine with the public key from the session identity key, and the relay can then decrypt such messages because it has the private key and the crypt header contains the public key it will combine with the private key it was sent for the session..

But this is an uncommon way of using elliptic curve keys and diffie hellman shared secret derivation, because it is about the session, and the session identity and session encryption both require the relay to have the private key.

If your head is spinning after reading that, don't worry, it gives me severe dyslexia trying to explain how it works, the words are difficult. In my mind it is just a geometric pattern of entities interacting in various ways.