Lightning for Builders Protocol
Lightning's encrypted message transport
Every peer link is encrypted and authenticated with the Noise protocol before a single Lightning message flows. What the handshake does, and what your node's connections look like.
25 minIntermediate14 / 17
Draft: this lesson is still waiting for review.
What you'll learn
- Explain why Lightning encrypts and authenticates every peer connection
- Describe the three acts of the Noise_XK handshake in plain words
- Inspect a node's live peer connections
Key terms
- public key (ufunguo wa umma)
- A number derived from your private key. Others use it to check your signature without learning your secret.
- node (nodi)
- A computer running Bitcoin or Lightning software that checks every rule for itself.
When Alice connected to Bob in lesson 3, you typed BOB_PUBKEY@bob:9735. That public key wasn't just an address: it is how Alice makes sure she is talking to the real Bob, over a link nobody else can read.
Why encrypt?
Lightning messages reveal a lot: which channels you have, which payments you are forwarding, which HTLCs are pending. Without encryption, anyone on the network path could watch, or even change, them. BOLT 8 gives every peer connection confidentiality (nobody can read it), integrity (nobody can change it unnoticed) and authentication (you know who is on the other end).
The Noise handshake, in three acts
Lightning uses the Noise_XK pattern. "K" means Alice already knows Bob's static public key.
- Act one. Alice sends a fresh, one-time public key, and proves she knows Bob's static key.
- Act two. Bob replies with his own one-time key. Both now share a secret that nobody watching can compute.
- Act three. Alice sends her static key, encrypted, and proves she owns it.
After 50 + 50 + 66 bytes, both sides have encryption keys, which are rotated every 1,000 messages. Only then does the init message from last lesson flow.
Look at Alice's connections
Look at the encrypted connections
These exercises need a laptop with the lab running. You can read the lesson on your phone.
Each peer shows its public key, the address it connected through, and how many bytes have flowed, all of them encrypted.
Reflect
Write your answer down, or talk it over with a friend or your chama.
- Why does the connecting node need to know the other node's public key in advance?
- What could an attacker on the same Wi-Fi learn if Lightning messages were not encrypted?
Check yourself
Further reading
Adapted from Mastering the Lightning Network. Andreas M. Antonopoulos, Olaoluwa Osuntokun and René Pickhardt. Licence: CC BY-SA 4.0.