I am currently reviewing the transport layer of the Lightning network protocol. It builds on top of the noise protocol framework handshake patterns.
What I don't get: Why was the fundamental pattern
-> e, es 0 2
<- e, ee 2 1
-> s, se 2 5
<- 2 5
First of all why not
KK? Nodes are announced via gossip and on my tcp socket I should see who connected to me being able to look up the static key of my peer. Was the reason so that lightning nodes could be private and in particular on tor?
Second of all why not using protocols without static keys? Is the reason that we wanted to have property 2 and 5 for initiator and recipient respectively?
Sender authentication resistant to key-compromise impersonation (KCI) . The sender authentication is based on an ephemeral-static DH ("es" or "se") between the sender's static key pair and the recipient's ephemeral key pair. Assuming the corresponding private keys are secure, this authentication cannot be forged.
Encryption to a known recipient, strong forward secrecy. This payload is encrypted based on an ephemeral-ephemeral DH as well as an ephemeral-static DH with the recipient's static key pair. Assuming the ephemeral private keys are secure, and the recipient is not being actively impersonated by an attacker that has stolen its static private key, this payload cannot be decrypted.
It feels like I have given the answer by quoting from the noise protocol framework page. But maybe I am mistaking so it would be great to get your insights.