NKN Client Authorization
When a NKN client joins NKN network, it sends a RPC request to seed list to inquire which node that it should connect by webscoket.
After getting the websocket node information, the client connects to the node, and sends its client Id, public key to the node.
Then the node needs to check that the client is authorized to use this client address . This is what client authorization is for.
The main steps are here:
- A client connects to a node by webscoket;
- When getting a new connection from a client, the node generates 256 bit random data as a challenge , and send it to the client. This action is authChallenge;
- After getting the challenge data, the client generates 256 bit random data as client salt, appends it to challenge data, and get sha256 hash of it;
- The client signs the hash by its private key, gets a signature;
- The client sends the client salt, signature and client address to the node. This action is setClient;
- The node gets public key from the client address;
- The node verifies the signature by the client public key;
- If the verification is successful, the node keeps the connection, else the node disconnects the client.
The authorization process is shown as following sequence chart:
