mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-26 11:25:19 +00:00
jackandGitHub
16324c819f
Adds remote-static-key->peerID binding at Noise handshake completion (closes a mesh impersonation/MITM hole where a peer could complete a handshake under another peer's ID). Also hardens LEAVE handling to require a verified signature and suppresses relay of unverifiable leaves.
35 lines
1.1 KiB
Swift
35 lines
1.1 KiB
Swift
//
|
|
// NoiseSecurityConstants.swift
|
|
// bitchat
|
|
//
|
|
// This is free and unencumbered software released into the public domain.
|
|
// For more information, see <https://unlicense.org>
|
|
//
|
|
|
|
import Foundation
|
|
|
|
enum NoiseSecurityConstants {
|
|
// Maximum message size to prevent memory exhaustion
|
|
static let maxMessageSize = 65535 // 64KB as per Noise spec
|
|
|
|
// Maximum handshake message size
|
|
static let maxHandshakeMessageSize = 2048 // 2KB to accommodate XX pattern
|
|
|
|
// Noise XX message 1 contains only the initiator's 32-byte ephemeral key.
|
|
static let xxInitialMessageSize = 32
|
|
|
|
// Session timeout - sessions older than this should be renegotiated
|
|
static let sessionTimeout: TimeInterval = 86400 // 24 hours
|
|
|
|
// Maximum number of messages before rekey (2^64 - 1 is the nonce limit)
|
|
static let maxMessagesPerSession: UInt64 = 1_000_000_000 // 1 billion messages
|
|
|
|
// Rate limiting
|
|
static let maxHandshakesPerMinute = 10
|
|
static let maxMessagesPerSecond = 100
|
|
|
|
// Global rate limiting (across all peers)
|
|
static let maxGlobalHandshakesPerMinute = 30
|
|
static let maxGlobalMessagesPerSecond = 500
|
|
}
|