以太坊执行层P2P网络架构与设计:Discv5

概述

读者可以前往我的博客获得更好的阅读体验。

关于以太坊的P2P网络问题;目前的资料较为零散;本文尝试结合具体的go-ethereum源代码;尽可能为读者完整介绍以太坊所使用的ÐΞVp2p(devp2p)网络架构和运转流程。

devp2p各协议栈之间的关系可以参考下图:

其中;node Discovery Protocol v5运行在UDP上;其余均运行在TCP协议上。

本文会以节点第一次进入以太坊P2P网络的流程为主线;介绍Node Discovery Protocol v5中各个模块的构成和作用。

前置知识

本文将介绍的很多组件均依赖于RLP;所以在此处我们对其首先进行介绍。

RLP 编码

在以太坊中;我们使用的最基本的编码格式就是RLP编码(递归长度前缀解码);这是一种特殊的序列化形式。RLP可以对以下内容进行编码:

为了方便读者理解RLP编码的具体功能和实现;我们将采用先介绍解码;再介绍编码的形式。

对于RLP的解码;流程如下:

上述流程也说明了此编码协议的名称的由来。读者可以通过此工具为RLP online辅助学习。

接下来我们介绍二进制字节解码的规则:

接下来;我们给出具体的实例:

0x8b68656c6c6f20776f726c64

对于上述内容进行解码;首先我们读取第一字节0x8b;发现此字节符合条件3;我们协议计算字符串长度为0x8b - 0x80;即 11 bytes;这意味着字符串的具体长度为11 bytes。我们依照此长度读取11 bytes;就获得了解码后的数据0x68656c6c6f20776f726c64。

如果你可以确认此数据的编码格式就可以进行下一步编码;在此处我们给出的数据使用了UTF-8编码;转换后为hello world。

另一个例子如下:

0xb90400(61)*1024

(61)*1024的意思为61连续重复1024次。依照上述流程;我们首先读取前缀0xb9;发现其大于0xb8;相减后获得0xb9 - 0xb7;即2 bytes。我们读取后2 bytes;即0400(1024);这是最终的二进制字节长度;我们再读取1024 bytes;获得(61) * 1024。

同理;此处我们也使用了utf-8编码;转换后为A

综合使用上述规则;我们可以编码长度低于65536 bytes的二进制字节。

接下来;我们介绍列表的解码规则:

此规则与二进制字节的解码规则类似。

一个简单的例子:

0xcc 8568656c6c6f 85776f726c64

上述示例加空格只为了更好划分结构

我们首先读取前缀0xcc;发现此数据结构为列表且长度为0xcc - 0xc0;即12。获得此消息后我们对后文数据进行读取;后文数据为两个字符串;读者可以根据上文给出的方法自行解码。将最后的数据使用utf-8解码后获得[;hello;,;world;]

如果读者对代码实现感兴趣;我非常建议阅读go-ethereum的源代码。

ECDH

ECDH是一种基于椭圆函数曲线的Diffie–Hellman密钥协商算法。通过此算法;两个节点可以在不安全的信道中交换生成对称密码学的密钥。为方便对算法实现进行介绍;我们假设节点A与节点B需要进行ECDH生成对称密码学密钥;同时节点A和节点B都可以简单获得对方的公钥。

交换流程如下:

证明如下:

节点A的公钥为 Q A = d A ⋅ G Q_A = d_Acdot G QA​=dA​⋅G ;其中 d A d_A dA​ 为节点A的私钥

节点B的公钥为 Q B = d B ⋅ G Q_B = d_Bcdot G QB​=dB​⋅G ;其中 d B d_B dB​ 为节点A的私钥

依照上述给出的流程;结果如下:

节点A生成的密钥为 d A ⋅ Q B = d A ⋅ d B ⋅ G d_Acdot Q_B = d_Acdot d_Bcdot G dA​⋅QB​=dA​⋅dB​⋅G

节点B生成的密钥为 d B ⋅ Q A = d B ⋅ d A ⋅ G d_Bcdot Q_A = d_Bcdot d_Acdot G dB​⋅QA​=dB​⋅dA​⋅G

显然;生成的密钥是相同的;完成了密钥的交换。

HKDF

HKDF是一种基于HMAC的密钥推导算法;由RFC5869进行了相关定义。其功能为给定随机密钥生成材料(如上文获得的ECDH对称密钥);经过HKDF函数可以获得给定长度的具有高密码学强度的密钥。简单来说;可以将此算法看作密钥长度转换算法。

在了解HKDF前;我们首先需要知道HMAC的运作原理;如下图:

我们在此处不详细介绍具体流程。读者若感兴趣;建议阅读《图解密码技术》 第三版的 194 页部分;非常详细介绍了相关的计算流程。上图即来自此书。

在了解了HMAC流程后;我们就可以介绍HKDF的相关流程。我们以上文生成的密钥作为基础材料;记为secret;并使用 SHA256 作为哈希算法;目标是获得长度为 256 位的标准密钥。

第一步;将secret作为信息;使用给定或随机生成的salt作为密钥进行HMAC计算获得MAC值
第二步;我们需要获得 256 位的密钥;计算密钥长度与哈希算法输出值之间的比值并向上取整;此数值记为n。由于此处我们选择的哈希算法与密钥长度正好相同;所以计算结果为n = 1。接下来;我们进行以下计算:

T(0) = empty string (zero length)
T(1) = HMAC-Hash(PRK, T(0) | info | 0x01)
T(2) = HMAC-Hash(PRK, T(1) | info | 0x02)
T(3) = HMAC-Hash(PRK, T(2) | info | 0x03)
...
T(n) = HMAC-Hash(PRK, T(n-1) | info | hex(n))

将上述结果进行拼接T = T(1) | T(2) | T(3) | ... | T(N);最后选择T的前 256 位作为密钥。

在Go语言中;我们可以使用以下golang.org/x/crypto中的官方实现:

func New(hash func() hash.Hash, secret, salt, info []byte) io.Reader

具体文档可参考这里

Node Discovery Protocol v5

作为一个全新的节点;加入以太坊网络最重要的一步就是尽可能与其他节点建立链接;完善自己的节点列表。下图表示了发现以太坊网络节点的流程:

我们会逐一解释其中每一个过程使用的具体协议和协议定义。

初始节点获得

当我们启动一个全新节点时;我们会与go-ethereum规定的启动节点进行通信;这些节点的地址被硬编码在go-ethereum源代码中;读者可以前往此处查看。我们可以看到其中有几种典型的编码格式;如下:

形如enode://d860a01f9722d78051619d1e2351aba3f43f943f6f00718d1b9baa4101932a1f5011f16bb2b1bb35db20d6fe28fa0bf09636d26a87d31de9ec6203eeedb1f666;18.138.108.67:30303;其中d860a01f9722d78051619d1e2351aba3f43f943f6f00718d1b9baa4101932a1f5011f16bb2b1bb35db20d6fe28fa0bf09636d26a87d31de9ec6203eeedb1f666为节点运营者的未压缩公钥;其余数据为IP地址和端口号

形如enr:-KG4QOtcP9X1FbIMOe17QNMKqDxCpm14jcX5tiOE4_TyMrFqbmhPZHK_ZPG2Gxb1GE2xdtodOfx9-cgvNtxnRyHEmC0ghGV0aDKQ9aX9QgAAAAD__________4JpZIJ2NIJpcIQDE8KdiXNlY3AyNTZrMaEDhpehBDbZjM_L9ek699Y7vhUJ-eAdMyQW_Fil522Y0fODdGNwgiMog3VkcIIjKA;此形式使用了ENR编码格式;由EIP778进行了相关定义。

形如enrtree://AKA3AM6LPBYEUDMVNU3BSVQJ5AD45Y7YPOHJLEF6W26QOE4VTUDPE;此形式使用了enrtree的编码格式;由EIP1459进行定义;主要用于通过DNS查询对等节点

上述不同的编码格式中enode格式最简单且具有自解释性;我们不会在后文进行讨论。后文主要讨论enr和enrtree形式。读者可以通过enode中的公钥在EtherNode查询到所有节点的信息。

ENR

ENR相较于较好理解的enode格式由以下优势:

在编码中;我们需要依次编码以下数据:

此处的其他键值数据理论上可以随意填写;填写时应保证键在前、值在后;同时尽可以保证字符使用ASCII编码。但EIP1459对于以下字段进行了预定义:

其中键后的括号表示其名称的ASCII编码结果

接下来;我们给出以下参数:

我们使用上述参数构建此节点的enr。

首先我们需要获得公钥;通过此网站;我们可以获得压缩公钥为ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd3138;未压缩公钥为ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd31387574077f301b421bc84df7266c44e9e6d569fc56be00812904767bf5ccd1fc7f

在此处;我们删去0x03和0x04是因为此两者仅作为标识符;无实际意义。

获得公钥后;我们对上述信息进行编码;格式如下:

[
    ;0x01;, #此数值即;seq;
    ;id;,
    ;v4;,
    ;ip;,
    7f000001,
    ;secp256k1;,
    03ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd3138,
    ;udp;,
    765f, # ;303030;的16进制形式
]

获得上述数据后;根据我们已经介绍过的的RLP进行编码(字符应使用ASCII转换为16 进制);结果如下:

0xf84201826964827634826970847f00000189736563703235366b31a103ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd31388375647082765f

使用私钥对上述结果进行签名;获得签名结果0x7098ad865b00a582051940cb9cf36836572411a47278783077011599ed5cd16b76f2635f4e234738f30813a89eb9137e3e3df5266e3a1f11df72ecf1145ccb9c27。

上图显示了自签名中恢复公钥

获得公钥后;我们需要重新进行信息编码;如下:

[
    7098ad865b00a582051940cb9cf36836572411a47278783077011599ed5cd16b76f2635f4e234738f30813a89eb9137e3e3df5266e3a1f11df72ecf1145ccb9c,
    01,
    ;id;,
    ;v4;,
    ;ip;,
    7f000001,
    ;secp256k1;,
    03ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd3138,
    ;udp;,
    765f,
]

进行RLP编码;如下:

f884b8407098ad865b00a582051940cb9cf36836572411a47278783077011599ed5cd16b76f2635f4e234738f30813a89eb9137e3e3df5266e3a1f11df72ecf1145ccb9c01826964827634826970847f00000189736563703235366b31a103ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd31388375647082765f

完成上述任务后;我们需要对最终结果进行base64编码;注意此处使用了特殊的URL and Filename safe映射表;与一般的base64编码不同。如在Python中;普通的的base64使用base64.b64encode;而URL and Filename safe使用了base64.urlsafe_b64encode。

使用以下Python代码即可实现编码:

>>> data = bytes.fromhex(;f884b8407098ad865b00a582051940cb9cf36836572411a47278783077011599ed5cd16b76f2635f4e234738f30813a89eb9137e3e3df5266e3a1f11df72ecf1145ccb9c01826964827634826970847f00000189736563703235366b31a103ca634cae0d49acb401d8a4c6b6fe8c55b70d115bf400769cc1400f3258cd31388375647082765f
;)
>>> base64.urlsafe_b64encode(data)
b;-IS4QHCYrYZbAKWCBRlAy5zzaDZXJBGkcnh4MHcBFZntXNFrdvJjX04jRzjzCBOonrkTfj499SZuOh8R33Ls8RRcy5wBgmlkgnY0gmlwhH8AAAGJc2VjcDI1NmsxoQPKY0yuDUmstAHYpMa2_oxVtw0RW_QAdpzBQA8yWM0xOIN1ZHCCdl8=;

enr:-IS4QHCYrYZbAKWCBRlAy5zzaDZXJBGkcnh4MHcBFZntXNFrdvJjX04jRzjzCBOonrkTfj499SZuOh8R33Ls8RRcy5wBgmlkgnY0gmlwhH8AAAGJc2VjcDI1NmsxoQPKY0yuDUmstAHYpMa2_oxVtw0RW_QAdpzBQA8yWM0xOIN1ZHCCdl8

const dnsPrefix = ;enrtree://AKA3AM6LPBYEUDMVNU3BSVQJ5AD45Y7YPOHJLEF6W26QOE4VTUDPE;;

func KnownDNSNetwork(genesis common.Hash, protocol string) string {
	var net string
	switch genesis {
	case MainnetGenesisHash:
		net = ;mainnet;
	case RopstenGenesisHash:
		net = ;ropsten;
	case RinkebyGenesisHash:
		net = ;rinkeby;
	case GoerliGenesisHash:
		net = ;goerli;
	case SepoliaGenesisHash:
		net = ;sepolia;
	default:
		return ;;
	}
	return dnsPrefix ; protocol ; ;.; ; net ; ;.ethdisco.net;
}

func parseLink(e string) (*linkEntry, error) {
	if !strings.HasPrefix(e, linkPrefix) {
		return nil, fmt.Errorf(;wrong/missing scheme ;enrtree; in URL;)
	}
	e = e[len(linkPrefix):]
	pos := strings.IndexByte(e, ;;;)
	if pos == -1 {
		return nil, entryError{;link;, errNoPubkey}
	}
	keystring, domain := e[:pos], e[pos;1:]
	keybytes, err := b32format.DecodeString(keystring)
	if err != nil {
		return nil, entryError{;link;, errBadPubkey}
	}
	key, err := crypto.DecompressPubkey(keybytes)
	if err != nil {
		return nil, entryError{;link;, errBadPubkey}
	}
	return &linkEntry{e, domain, key}, nil
}

func (c *Client) resolveRoot(ctx context.Context, loc *linkEntry) (rootEntry, error) {
	e, err, _ := c.singleflight.Do(loc.str, func() (interface{}, error) {
		txts, err := c.cfg.Resolver.LookupTXT(ctx, loc.domain)
		c.cfg.Logger.Trace(;Updating DNS discovery root;, ;tree;, loc.domain, ;err;, err)
		if err != nil {
			return rootEntry{}, err
		}
		for _, txt := range txts {
			if strings.HasPrefix(txt, rootPrefix) {
				return parseAndVerifyRoot(txt, loc)
			}
		}
		return rootEntry{}, nameError{loc.domain, errNoRoot}
	})
	return e.(rootEntry), err
}

;; ANSWER SECTION:
all.mainnet.ethdisco.net. 266   IN      TXT     
;enrtree-root:v1 e=WWP2ZHNHHZO3K5Y5T2VMGV7GXU l=FDXN3SN67NA5DKA4J2GOK7BVQI seq=3315 sig=YvkxX3lGYBRwpasJ7a73acOtQg_kbK51uFt2_1RQ4uR8Jq9dFD_fxE9WiZKNBZjgo8hmNcsqVoP82xHo3vos3gE;

func parseAndVerifyRoot(txt string, loc *linkEntry) (rootEntry, error) {
	e, err := parseRoot(txt)
	if err != nil {
		return e, err
	}
	if !e.verifySignature(loc.pubkey) {
		return e, entryError{typ: ;root;, err: errInvalidSig}
	}
	return e, nil
}

struct {
    eroot string
    lroot string
    seq uint
    sig []byte
}

WWP2ZHNHHZO3K5Y5T2VMGV7GXU.all.mainnet.ethdisco.net. 1 IN TXT
;enrtree-branch:DT4G4IMIRQLGT55XIRYTC2JWQM,2TDZ2XP33G656AAUOJ3GVKUHJE;

enrtree-branch:
    3AZRES3OYSPP74C6OGTEEY3TBY, 57MTMJGUCEDELSGUBH65ZS54HE,33OL5MHULIAPCZBPSLICSLGEGU, 2TU2RXC2SQ5WQGNVD2QNDW45PI,HWPZ7Y56NWL7J7ZQFBNM4OSV6Y, IHZ66V3WAQLJVQAAQJTPCNK5NM,5NTCRHGPNY7CDOFCG2G44L7NCY, J4C7XS534WNRLWVWJ6LGYDKVMI,3ZWH74DECJXURPAKZQPA4BO5YA, NQDK5ZKHFVT25NBYJACBLKNYGA,OV3QA3PIGBGMHYMVZA2RES3Q7U, 3X5KEPA2RJ7MFBD7ZB4R52ZANI,47ALRD6236JBOYOHLAZTHY4VFA

enrtree-branch:
    PS2VTC25LB55L6QRIB4Z3DLKY4,GLWRNB5ZJYRBGI7FMKD44PT5AQ,3M273RBSBOBVDEBEVJT7MVC46Y,NYYGSM2JJD5GPY4A2SEDZOJOPM,LCHQX7DYYHZ4FT2YKMU55SPTOM,RSSYWFUH5YSHFWSHMPCOZEBMFE,2EG45KXXIREOYP2XFTWEDIOTSU,EQ2JFJQGM424ME55MQU2PGWU7Y,IQ2MQX655ZGGJYXFFGKVJS6JEI,OS6X2RCMSLIIJLM3TTH4SNPXLY,OKKX647BKCSKW5IW66FZLJEHVE,SHYCCNLQ56LVZN3SBNZ4BTCAZA,OJXE42P53GW5DREZ3ORGIQ735E

enrtree-branch:
    EQB6BANBDY7S6FB3CXOAKAKHPQ,N6FVBKKHHHRT627FZUHSFRE7WE,JSTWYETUXFWA77QY2INZERLNLQ,JBHMNHDUML7RLNT5A543V3TMOM,DH37OCQEZKYK5BEUBQQQCXRTDM,4N4AGKDNCLK5ROKJRIU5PF4Z4U,Z5NSNKIVJ3QUSWV6GOVRGCZK5E,WXIGMPPKXEU7LBDCF4VJMFXCXQ,PA5RYZUMUF3ICVQ7ARODPK3R5A,2E2CA3EIDS2ICERHIFETVSCDVY,AYDMO4ZAUNSAWM2SI5LOX3SZZ4,EKA7L5PRXNDAAHLPMZPHIMKHIY,YHXXS4MU5RVBRZDZZMKLJ542LE

enr:-Je4QONq94Aa-VkvtRb0klXhGpVGW4mH1BwrfJU9chEjpSviCq8YThCiAD5oZz4UCDexfhLMXMV4kgaz_oOkti2TB5EHg2V0aMfGhCDDJ_yAgmlkgnY0gmlwhIjzL2CJc2VjcDI1NmsxoQLJV1XQ65-I37gAQi3zDisSClBqJ2u9Zrz3HxC8rW3kRoN0Y3CCdl-DdWRwgnZf

packet = masking-iv || masked-header || message

header        = static-header || authdata
static-header = protocol-id || version || flag || nonce || authdata-size
protocol-id   = ;discv5;
version       = 0x0001
authdata-size = uint16    -- byte length of authdata
flag          = uint8     -- packet type identifier
nonce         = uint96    -- nonce of message

func generateNonce(counter uint32) (n Nonce, err error) {
	binary.BigEndian.PutUint32(n[:4], counter)
	_, err = crand.Read(n[4:])
	return n, err
}

type StaticHeader struct {
	ProtocolID [6]byte
	Version    uint16
	Flag       byte
	Nonce      Nonce
	AuthSize   uint16
}

func (h *Header) mask(destID enode.ID) cipher.Stream {
	block, err := aes.NewCipher(destID[:16])
	if err != nil {
		panic(;can;t create cipher;)
	}
	return cipher.NewCTR(block, h.IV[:])
}

message       = aesgcm_encrypt(initiator-key, nonce, message-pt, message-ad)
message-pt    = message-type || message-data
message-ad    = masking-iv || header

func (c *Codec) encryptMessage(s *session, p Packet, head *Header, headerData []byte) ([]byte, error) {
	// Encode message plaintext.
	c.msgbuf.Reset()
	c.msgbuf.WriteByte(p.Kind())
	if err := rlp.Encode(&c.msgbuf, p); err != nil {
		return nil, err
	}
	messagePT := c.msgbuf.Bytes()

	// Encrypt into message ciphertext buffer.
	messageCT, err := encryptGCM(c.msgctbuf[:0], s.writeKey, head.Nonce[:], messagePT, headerData)
	if err == nil {
		c.msgctbuf = messageCT
	}
	return messageCT, err
}

type Codec struct {
	sha256    hash.Hash
	localnode *enode.LocalNode
	privkey   *ecdsa.PrivateKey
	sc        *SessionCache

	// encoder buffers
	buf      bytes.Buffer // whole packet
	headbuf  bytes.Buffer // packet header
	msgbuf   bytes.Buffer // message RLP plaintext
	msgctbuf []byte       // message data ciphertext

	// decoder buffer
	reader bytes.Reader
}

authdata      = src-id
authdata-size = 32

func (c *Codec) encodeRandom(toID enode.ID) (Header, []byte, error) {
	head := c.makeHeader(toID, flagMessage, 0)

	// Encode auth data.
	auth := messageAuthData{SrcID: c.localnode.ID()}
	if _, err := crand.Read(head.Nonce[:]); err != nil {
		return head, nil, fmt.Errorf(;can;t get random data: %v;, err)
	}
	c.headbuf.Reset()
	binary.Write(&c.headbuf, binary.BigEndian, auth)
	head.AuthData = c.headbuf.Bytes()

	// Fill message ciphertext buffer with random bytes.
	c.msgctbuf = append(c.msgctbuf[:0], make([]byte, randomPacketMsgSize)...)
	crand.Read(c.msgctbuf)
	return head, c.msgctbuf, nil
}

// No keys, send random data to kick off the handshake.
head, msgData, err = c.encodeRandom(id)

authdata      = id-nonce || enr-seq
authdata-size = 24
id-nonce      = uint128   -- random bytes
enr-seq       = uint64    -- ENR sequence number of the requesting node

func (c *Codec) encodeWhoareyou(toID enode.ID, packet *Whoareyou) (Header, error) {
	// Sanity check node field to catch misbehaving callers.
	if packet.RecordSeq > 0 && packet.Node == nil {
		panic(;BUG: missing node in whoareyou with non-zero seq;)
	}

	// Create header.
	head := c.makeHeader(toID, flagWhoareyou, 0)
	head.AuthData = bytesCopy(&c.buf)
	head.Nonce = packet.Nonce

	// Encode auth data.
	auth := &whoareyouAuthData{
		IDNonce:   packet.IDNonce,
		RecordSeq: packet.RecordSeq,
	}
	c.headbuf.Reset()
	binary.Write(&c.headbuf, binary.BigEndian, auth)
	head.AuthData = c.headbuf.Bytes()
	return head, nil
}

authdata      = authdata-head || id-signature || eph-pubkey || record
authdata-head = src-id || sig-size || eph-key-size
authdata-size = 34 ; sig-size ; eph-key-size ; len(record)
sig-size      = uint8     -- value: 64 for ID scheme ;v4;
eph-key-size  = uint8     -- value: 33 for ID scheme ;v4;

func (c *Codec) encodeHandshakeHeader(toID enode.ID, addr string, challenge *Whoareyou) (Header, *session, error) {
	// Ensure calling code sets challenge.node.
	if challenge.Node == nil {
		panic(;BUG: missing challenge.Node in encode;)
	}

	// Generate new secrets.
	auth, session, err := c.makeHandshakeAuth(toID, addr, challenge)
	if err != nil {
		return Header{}, nil, err
	}

	// Generate nonce for message.
	nonce, err := c.sc.nextNonce(session)
	if err != nil {
		return Header{}, nil, fmt.Errorf(;can;t generate nonce: %v;, err)
	}

	// TODO: this should happen when the first authenticated message is received
	c.sc.storeNewSession(toID, addr, session)

	// Encode the auth header.
	var (
		authsizeExtra = len(auth.pubkey) ; len(auth.signature) ; len(auth.record)
		head          = c.makeHeader(toID, flagHandshake, authsizeExtra)
	)
	c.headbuf.Reset()
	binary.Write(&c.headbuf, binary.BigEndian, &auth.h)
	c.headbuf.Write(auth.signature)
	c.headbuf.Write(auth.pubkey)
	c.headbuf.Write(auth.record)
	head.AuthData = c.headbuf.Bytes()
	head.Nonce = nonce
	return head, session, err
}

func (t *UDPv5) handleUnknown(p *v5wire.Unknown, fromID enode.ID, fromAddr *net.UDPAddr) {
	challenge := &v5wire.Whoareyou{Nonce: p.Nonce}
	crand.Read(challenge.IDNonce[:])
	if n := t.getNode(fromID); n != nil {
		challenge.Node = n
		challenge.RecordSeq = n.Seq()
	}
	t.sendResponse(fromID, fromAddr, challenge)
}

func (t *UDPv5) matchWithCall(fromID enode.ID, nonce v5wire.Nonce) (*callV5, error) {
	c := t.activeCallByAuth[nonce]
	if c == nil {
		return nil, errChallengeNoCall
	}
	if c.handshakeCount > 0 {
		return nil, errChallengeTwice
	}
	return c, nil
}

authdata      = authdata-head || id-signature || eph-pubkey || record
authdata-head = src-id || sig-size || eph-key-size
authdata-size = 34 ; sig-size ; eph-key-size ; len(record)
sig-size      = uint8     -- value: 64 for ID scheme ;v4;
eph-key-size  = uint8     -- value: 33 for ID scheme ;v4;

challenge-data     = masking-iv || static-header || authdata

ephemeral-key      = 节点A随机生成的私钥
ephemeral-pubkey   = 与上述私钥对应的公钥

func deriveKeys(hash hashFn, priv *ecdsa.PrivateKey, pub *ecdsa.PublicKey, n1, n2 enode.ID, challenge []byte) *session {
	const text = ;discovery v5 key agreement;
	var info = make([]byte, 0, len(text);len(n1);len(n2))
	info = append(info, text...)
	info = append(info, n1[:]...)
	info = append(info, n2[:]...)

	eph := ecdh(priv, pub)
	if eph == nil {
		return nil
	}
	kdf := hkdf.New(hash, eph, challenge, info)
	sec := session{writeKey: make([]byte, aesKeySize), readKey: make([]byte, aesKeySize)}
	kdf.Read(sec.writeKey)
	kdf.Read(sec.readKey)
	for i := range eph {
		eph[i] = 0
	}
	return &sec
}

func idNonceHash(h hash.Hash, challenge, ephkey []byte, destID enode.ID) []byte {
	h.Reset()
	h.Write([]byte(;discovery v5 identity proof;))
	h.Write(challenge)
	h.Write(ephkey)
	h.Write(destID[:])
	return h.Sum(nil)
}

func makeIDSignature(hash hash.Hash, key *ecdsa.PrivateKey, challenge, ephkey []byte, destID enode.ID) ([]byte, error) {
	input := idNonceHash(hash, challenge, ephkey, destID)
	switch key.Curve {
	case crypto.S256():
		idsig, err := crypto.Sign(input, key)
		if err != nil {
			return nil, err
		}
		return idsig[:len(idsig)-1], nil // remove recovery ID
	default:
		return nil, fmt.Errorf(;unsupported curve %s;, key.Curve.Params().Name)
	}
}

func (c *Codec) decodeHandshake(fromAddr string, head *Header) (n *enode.Node, auth handshakeAuthData, s *session, err error) {
	if auth, err = c.decodeHandshakeAuthData(head); err != nil {
		return nil, auth, nil, err
	}

	// Verify against our last WHOAREYOU.
	challenge := c.sc.getHandshake(auth.h.SrcID, fromAddr)
	if challenge == nil {
		return nil, auth, nil, errUnexpectedHandshake
	}
	// Get node record.
	n, err = c.decodeHandshakeRecord(challenge.Node, auth.h.SrcID, auth.record)
	if err != nil {
		return nil, auth, nil, err
	}
	// Verify ID nonce signature.
	sig := auth.signature
	cdata := challenge.ChallengeData
	err = verifyIDSignature(c.sha256, sig, n, cdata, auth.pubkey, c.localnode.ID())
	if err != nil {
		return nil, auth, nil, err
	}
	// Verify ephemeral key is on curve.
	ephkey, err := DecodePubkey(c.privkey.Curve, auth.pubkey)
	if err != nil {
		return nil, auth, nil, errInvalidAuthKey
	}
	// Derive sesssion keys.
	session := deriveKeys(sha256.New, c.privkey, ephkey, auth.h.SrcID, c.localnode.ID(), cdata)
	session = session.keysFlipped()
	return n, auth, session, nil
}

func (c *Codec) decodeHandshake(fromAddr string, head *Header) (n *enode.Node, auth handshakeAuthData, s *session, err error) {
	if auth, err = c.decodeHandshakeAuthData(head); err != nil {
		return nil, auth, nil, err
	}

	// Verify against our last WHOAREYOU.
	challenge := c.sc.getHandshake(auth.h.SrcID, fromAddr)
	if challenge == nil {
		return nil, auth, nil, errUnexpectedHandshake
	}
	// Get node record.
	n, err = c.decodeHandshakeRecord(challenge.Node, auth.h.SrcID, auth.record)
	if err != nil {
		return nil, auth, nil, err
	}
	// Verify ID nonce signature.
	sig := auth.signature
	cdata := challenge.ChallengeData
	err = verifyIDSignature(c.sha256, sig, n, cdata, auth.pubkey, c.localnode.ID())
	if err != nil {
		return nil, auth, nil, err
	}
	// Verify ephemeral key is on curve.
	ephkey, err := DecodePubkey(c.privkey.Curve, auth.pubkey)
	if err != nil {
		return nil, auth, nil, errInvalidAuthKey
	}
	// Derive sesssion keys.
	session := deriveKeys(sha256.New, c.privkey, ephkey, auth.h.SrcID, c.localnode.ID(), cdata)
	session = session.keysFlipped()
	return n, auth, session, nil
}

func LogDist(a, b ID) int {
	lz := 0
	for i := range a {
		x := a[i] ^ b[i]
		if x == 0 {
			lz ;= 8
		} else {
			lz ;= bits.LeadingZeros8(x)
			break
		}
	}
	return len(a)*8 - lz
}

func (tab *Table) doRevalidate(done chan<- struct{}) {
	defer func() { done <- struct{}{} }()

	last, bi := tab.nodeToRevalidate()
	if last == nil {
		// No non-empty bucket found.
		return
	}

	// Ping the selected node and wait for a pong.
	remoteSeq, err := tab.net.ping(unwrapNode(last))

	// Also fetch record if the node replied and returned a higher sequence number.
	if last.Seq() < remoteSeq {
		n, err := tab.net.RequestENR(unwrapNode(last))
		if err != nil {
			tab.log.Debug(;ENR request failed;, ;id;, last.ID(), ;addr;, last.addr(), ;err;, err)
		} else {
			last = &node{Node: *n, addedAt: last.addedAt, livenessChecks: last.livenessChecks}
		}
	}

	tab.mutex.Lock()
	defer tab.mutex.Unlock()
	b := tab.buckets[bi]
	if err == nil {
		// The node responded, move it to the front.
		last.livenessChecks;;
		tab.log.Debug(;Revalidated node;, ;b;, bi, ;id;, last.ID(), ;checks;, last.livenessChecks)
		tab.bumpInBucket(b, last)
		return
	}
	// No reply received, pick a replacement or delete the node if there aren;t
	// any replacements.
	if r := tab.replace(b, last); r != nil {
		tab.log.Debug(;Replaced dead node;, ;b;, bi, ;id;, last.ID(), ;ip;, last.IP(), ;checks;, last.livenessChecks, ;r;, r.ID(), ;rip;, r.IP())
	} else {
		tab.log.Debug(;Removed dead node;, ;b;, bi, ;id;, last.ID(), ;ip;, last.IP(), ;checks;, last.livenessChecks)
	}
}

message-data = [request-id, [distance₁, distance₂, ..., distanceₙ]]
message-type = 0x03
distanceₙ    = requested log2 distance, a positive integer

func (t *UDPv5) newRandomLookup(ctx context.Context) *lookup {
	var target enode.ID
	crand.Read(target[:])
	return t.newLookup(ctx, target)
}

func (t *UDPv5) newLookup(ctx context.Context, target enode.ID) *lookup {
	return newLookup(ctx, t.tab, target, func(n *node) ([]*node, error) {
		return t.lookupWorker(n, target)
	})
}

func (t *UDPv5) collectTableNodes(rip net.IP, distances []uint, limit int) []*enode.Node {
	var nodes []*enode.Node
	var processed = make(map[uint]struct{})
	for _, dist := range distances {
		// Reject duplicate / invalid distances.
		_, seen := processed[dist]
		if seen || dist > 256 {
			continue
		}

		// Get the nodes.
		var bn []*enode.Node
		if dist == 0 {
			bn = []*enode.Node{t.Self()}
		} else if dist <= 256 {
			t.tab.mutex.Lock()
			bn = unwrapNodes(t.tab.bucketAtDistance(int(dist)).entries)
			t.tab.mutex.Unlock()
		}
		processed[dist] = struct{}{}

		// Apply some pre-checks to avoid sending invalid nodes.
		for _, n := range bn {
			// TODO livenessChecks > 1
			if netutil.CheckRelayIP(rip, n.IP()) != nil {
				continue
			}
			nodes = append(nodes, n)
			if len(nodes) >= limit {
				return nodes
			}
		}
	}
	return nodes
}