# ADR 010: Crypto Changes

## Context

Tendermint is a cryptographic protocol that uses and composes a variety of cryptographic primitives.

After nearly 4 years of development, Tendermint has recently undergone multiple security reviews to search for vulnerabilities and to assess the the use and composition of cryptographic primitives.

### Hash Functions

Tendermint uses RIPEMD160 universally as a hash function, most notably in its Merkle tree implementation.

RIPEMD160 was chosen because it provides the shortest fingerprint that is long enough to be considered secure (ie. birthday bound of 80-bits).
It was also developed in the open academic community, unlike NSA-designed algorithms like SHA256.

That said, the cryptographic community appears to unanimously agree on the security of SHA256. It has become a universal standard, especially now that SHA1 is broken, being required in TLS connections and having optimized support in hardware.

### Merkle Trees

Tendermint uses a simple Merkle tree to compute digests of large structures like transaction batches
and even blockchain headers. The Merkle tree length prefixes byte arrays before concatenating and hashing them.
It uses RIPEMD160.

### Addresses

ED25519 addresses are computed using the RIPEMD160 of the Amino encoding of the public key.
RIPEMD160 is generally considered an outdated hash function, and is much slower
than more modern functions like SHA256 or Blake2.

### Authenticated Encryption

Tendermint P2P connections use authenticated encryption to provide privacy and authentication in the communications.
This is done using the simple Station-to-Station protocol with the NaCL Ed25519 library.

While there have been no vulnerabilities found in the implementation, there are some concerns:

- NaCL uses Salsa20, a not-widely used and relatively out-dated stream cipher that has been obsoleted by ChaCha20
- Connections use RIPEMD160 to compute a value that is used for the encryption nonce with subtle requirements on how it's used

## Decision

### Hash Functions

Use the first 20-bytes of the SHA256 hash instead of RIPEMD160 for everything

### Merkle Trees

TODO

### Addresses

Compute ED25519 addresses as the first 20-bytes of the SHA256 of the raw 32-byte public key

### Authenticated Encryption

Make the following changes:

- Use xChaCha20 instead of xSalsa20 - https://github.com/tendermint/tendermint/issues/1124
- Use an HKDF instead of RIPEMD160 to compute nonces - https://github.com/tendermint/tendermint/issues/1165

## Status

Implemented

## Consequences

### Positive

- More modern and standard cryptographic functions with wider adoption and hardware acceleration

### Negative

- Exact authenticated encryption construction isn't already provided in a well-used library

### Neutral

## References