@@ -28,32 +28,32 @@ The following diagram shows how this key-exchange protocol executes when a new n
2828.. mermaid ::
2929
3030 sequenceDiagram
31- participant Primary as Primary (P)
32- participant Backup as Backup (B)
31+ participant Primary as Primary (P)
32+ participant Backup as Backup (B)
3333
34- Backup->>+Primary: Join request over TLS
35- Note over Primary: Consortium trusts backup
36- Primary-->>+Backup: Service identity S = {S_priv, S_pub} over TLS
34+ Backup->>+Primary: Join request over TLS
35+ Note over Primary: Consortium trusts backup
36+ Primary-->>+Backup: Service identity S = {S_priv, S_pub} over TLS
3737
38- Primary->>+Backup: key_exchange_init: {P's public key share} <br> signed with P's node cert (endorsed by S)
38+ Primary->>+Backup: key_exchange_init: {P's public key share} <br> signed with P's node cert (endorsed by S)
3939
40- Note over Backup: Verifies endorsement of P's cert with S_pub <br> Verifies signature with P's cert
40+ Note over Backup: Verifies endorsement of P's cert with S_pub <br> Verifies signature with P's cert
4141
42- Backup->>+Primary: key_exchange_response: {B's public key share + P's public key share} <br> signed with B's node cert (endorsed by S)
42+ Backup->>+Primary: key_exchange_response: {B's public key share + P's public key share} <br> signed with B's node cert (endorsed by S)
4343
44- Note over Primary: Verifies endorsement of B's cert with S_pub <br> verifies signature with B's cert
44+ Note over Primary: Verifies endorsement of B's cert with S_pub <br> verifies signature with B's cert
4545
46- Note over Primary: Derives channel send and recv keys from shared secret
46+ Note over Primary: Derives channel send and recv keys from shared secret
4747
48- Primary->>+Backup: key_exchange_final: {P's public key share + B's public key share} <br> signed with P's node cert (endorsed by S)
48+ Primary->>+Backup: key_exchange_final: {P's public key share + B's public key share} <br> signed with P's node cert (endorsed by S)
4949
50- Note over Backup: Verifies endorsement of P's cert with S_pub <br> Verifies signature with P's cert
50+ Note over Backup: Verifies endorsement of P's cert with S_pub <br> Verifies signature with P's cert
5151
52- Note over Backup: Derives channel send and recv keys from shared secret
52+ Note over Backup: Derives channel send and recv keys from shared secret
5353
5454 Note over Primary, Backup: Node-to-node channel between P and B is now established
5555
56- Primary->>+Backup: Consensus headers message (e.g. replication) <br> (integrity protected with channel key)
56+ Primary->>+Backup: Consensus headers message (e.g. replication) <br> (integrity protected with channel key)
5757 Backup->>+Primary: Consensus headers response
5858
5959 Backup->>+Primary: Forwarded client HTTP request <br> (encrypted with channel key)
@@ -81,11 +81,11 @@ The brief sequence diagram of a successful key exchange is as follows.
8181.. mermaid ::
8282
8383 sequenceDiagram
84- participant Node1 as Node1 (A)
85- participant Node2 as Node2 (B)
84+ participant Node1 as Node1 (A)
85+ participant Node2 as Node2 (B)
8686
8787 Note over Node1: state := Initiated
88- Node1->>+Node2: key_exchange_init
88+ Node1->>+Node2: key_exchange_init
8989
9090 Note over Node2: state := WaitingForFinal
9191 Node2->>+Node1: key_exchange_response
@@ -100,16 +100,16 @@ However, if messages are dropped this protocol can reach various deadlocked stat
100100.. mermaid ::
101101
102102 sequenceDiagram
103- participant N1 as Node 1
104- participant Node1 as Node1 Channel
105- participant Node2 as Node2 Channel
106- participant N2 as Node 2
103+ participant N1 as Node 1
104+ participant Node1 as Node1 Channel
105+ participant Node2 as Node2 Channel
106+ participant N2 as Node 2
107107
108108 N1 ->>+ Node1: send(2, M)
109109 Note over Node1: state := Initiated
110110
111111 alt init dropped
112- Node1 --x Node2: init
112+ Node1 --x Node2: init
113113
114114 rect rgba(200, 10, 10, .5)
115115 N2 ->>+ Node2: send(1, N)
@@ -118,7 +118,7 @@ However, if messages are dropped this protocol can reach various deadlocked stat
118118 Note over Node1: Ignored if lower-priority
119119 end
120120 else init delivered
121- Node1-->>+Node2: init
121+ Node1-->>+Node2: init
122122 Note over Node2: state := WaitingForFinal
123123
124124 alt response dropped
@@ -131,7 +131,7 @@ However, if messages are dropped this protocol can reach various deadlocked stat
131131
132132 rect rgba(200, 10, 10, .5)
133133 N1 ->>+ Node1: send(2, M)
134- Node1-->>+Node2: init
134+ Node1-->>+Node2: init
135135 Note over Node2: Ignored due to WaitingForFinal
136136 end
137137 else response delivered
0 commit comments