@aztec/p2p 1.2.1 → 2.0.0-nightly.20250813

package/src/services/peer-manager/peer_manager.ts

@@ -1,18 +1,25 @@
+import type { EpochCacheInterface } from '@aztec/epoch-cache';
+import { makeEthSignDigest, recoverAddress } from '@aztec/foundation/crypto';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import { Fr } from '@aztec/foundation/fields';
 import { createLogger } from '@aztec/foundation/log';
 import { bufferToHex } from '@aztec/foundation/string';
+import { DateProvider } from '@aztec/foundation/timer';
 import type { PeerInfo, WorldStateSynchronizer } from '@aztec/stdlib/interfaces/server';
 import type { PeerErrorSeverity } from '@aztec/stdlib/p2p';
 import { type TelemetryClient, trackSpan } from '@aztec/telemetry-client';
 
 import { ENR } from '@chainsafe/enr';
 import type { Connection, PeerId } from '@libp2p/interface';
+import { peerIdFromString } from '@libp2p/peer-id';
 import type { Multiaddr } from '@multiformats/multiaddr';
-import type { Libp2p } from 'libp2p';
 import { inspect } from 'util';
 
 import type { P2PConfig } from '../../config.js';
 import { PeerEvent } from '../../types/index.js';
+import type { FullLibp2p } from '../../util.js';
 import { ReqRespSubProtocol } from '../reqresp/interface.js';
+import { AuthRequest, AuthResponse } from '../reqresp/protocols/auth.js';
 import { GoodByeReason, prettyGoodbyeReason } from '../reqresp/protocols/goodbye.js';
 import { StatusMessage } from '../reqresp/protocols/status.js';
 import type { ReqResp } from '../reqresp/reqresp.js';
@@ -27,6 +34,7 @@ const MAX_CACHED_PEERS = 100;
 const MAX_CACHED_PEER_AGE_MS = 5 * 60 * 1000; // 5 minutes
 const FAILED_PEER_BAN_TIME_MS = 5 * 60 * 1000; // 5 minutes timeout after failing MAX_DIAL_ATTEMPTS
 const GOODBYE_DIAL_TIMEOUT_MS = 1000;
+const FAILED_AUTH_HANDSHAKE_EXPIRY_MS = 60 * 60 * 1000; // 1 hour
 
 type CachedPeer = {
   peerId: PeerId;
@@ -41,6 +49,11 @@ type TimedOutPeer = {
   timeoutUntilMs: number;
 };
 
+type FailedAuthHandshakeEntry = {
+  count: number;
+  lastFailureTimestamp: number;
+};
+
 export class PeerManager implements PeerManagerInterface {
   private cachedPeers: Map<string, CachedPeer> = new Map();
   private heartbeatCounter: number = 0;
@@ -50,6 +63,13 @@ export class PeerManager implements PeerManagerInterface {
   private trustedPeersInitialized: boolean = false;
   private privatePeers: Set<string> = new Set();
   private privatePeersInitialized: boolean = false;
+  private preferredPeers: Set<string> = new Set();
+  private authenticatedPeerIdToValidatorAddress: Map<string, EthAddress> = new Map();
+  private authenticatedValidatorAddressToPeerId: Map<string, PeerId> = new Map();
+  private peersToBeDisconnected: Set<string> = new Set();
+  private failedAuthHandshakes: Map<string, FailedAuthHandshakeEntry> = new Map();
+  private validatorAddresses: EthAddress[] = [];
+  private initializedPreferredPeers: boolean = false;
 
   private metrics: PeerManagerMetrics;
   private handlers: {
@@ -59,7 +79,7 @@ export class PeerManager implements PeerManagerInterface {
   };
 
   constructor(
-    private libP2PNode: Libp2p,
+    private libP2PNode: FullLibp2p,
     private peerDiscoveryService: PeerDiscoveryService,
     private config: P2PConfig,
     telemetryClient: TelemetryClient,
@@ -68,7 +88,12 @@ export class PeerManager implements PeerManagerInterface {
     private reqresp: ReqResp,
     private readonly worldStateSynchronizer: WorldStateSynchronizer,
     private readonly protocolVersion: string,
+    private readonly epochCache: EpochCacheInterface,
+    private readonly dateProvider: DateProvider = new DateProvider(),
   ) {
+    if (this.config.p2pDisableStatusHandshake && this.config.p2pAllowOnlyValidators) {
+      throw new Error('Status handshake disabled but is required to allow only validators to connect.');
+    }
     this.metrics = new PeerManagerMetrics(telemetryClient, 'PeerManager');
 
     // Handle Discovered peers
@@ -85,12 +110,11 @@ export class PeerManager implements PeerManagerInterface {
     this.libP2PNode.addEventListener(PeerEvent.DISCONNECTED, this.handlers.handleDisconnectedPeerEvent);
 
     // eslint-disable-next-line @typescript-eslint/no-misused-promises
-    this.peerDiscoveryService.on(PeerEvent.DISCOVERED, this.handlers.handleDiscoveredPeer);
+    this.peerDiscoveryService?.on(PeerEvent.DISCOVERED, this.handlers.handleDiscoveredPeer);
 
     // Display peer counts every 60 seconds
     this.displayPeerCountsPeerHeartbeat = Math.floor(60_000 / this.config.peerCheckIntervalMS);
   }
-
   /**
    * Initializes the trusted peers.
    *
@@ -124,6 +148,13 @@ export class PeerManager implements PeerManagerInterface {
         })
         .catch(e => this.logger.error('Error initializing private peers', e));
     }
+
+    if (this.config.preferredPeers) {
+      const preferredPeersEnrs: ENR[] = this.config.preferredPeers.map(enr => ENR.decodeTxt(enr));
+      await Promise.all(preferredPeersEnrs.map(enr => enr.peerId()))
+        .then(peerIds => peerIds.forEach(peerId => this.preferredPeers.add(peerId.toString())))
+        .catch(e => this.logger.error('Error initializing preferred peers', e));
+    }
   }
 
   get tracer() {
@@ -131,15 +162,70 @@ export class PeerManager implements PeerManagerInterface {
   }
 
   @trackSpan('PeerManager.heartbeat')
-  public heartbeat() {
+  public async heartbeat() {
     this.heartbeatCounter++;
     this.peerScoring.decayAllScores();
-
     this.cleanupExpiredTimeouts();
 
+    await this.setupDirectPeersIfValidator();
+    await this.updateAuthenticatedPeers();
+    await this.processScheduledDisconnects();
+
     this.discover();
   }
 
+  /*
+   * If this node is connecting to preferred peers, make sure it is registered validator */
+  async setupDirectPeersIfValidator() {
+    if (!this.config.preferredPeers) {
+      return;
+    }
+
+    // Already initialized preferred peers, don't wastefully repeat the same work
+    if (this.initializedPreferredPeers) {
+      return;
+    }
+
+    const registeredValidators = await this.epochCache.getRegisteredValidators();
+    const validatorSet = new Set(registeredValidators.map(v => v.toString()));
+    const isThisNodePartOfValidatorSet = this.validatorAddresses.some(v => validatorSet.has(v.toString()));
+
+    if (!isThisNodePartOfValidatorSet) {
+      return;
+    }
+
+    const preferredPeersEnrs: ENR[] = this.config.preferredPeers.map(enr => ENR.decodeTxt(enr));
+    await Promise.all(preferredPeersEnrs.map(enr => enr.peerId()))
+      .then(peerIds => peerIds.forEach(peerId => this.preferredPeers.add(peerId.toString())))
+      .catch(e => this.logger.error('Error initializing preferred peers', e));
+
+    const directPeers = (
+      await Promise.all(
+        preferredPeersEnrs.map(async enr => {
+          const peerId = await enr.peerId();
+          const address = enr.getLocationMultiaddr('tcp');
+          if (address === undefined) {
+            throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+          }
+          return {
+            id: peerId,
+            addrs: [address],
+          };
+        }),
+      )
+    ).filter(peer => peer !== undefined);
+
+    await Promise.all(
+      directPeers.map(peer => {
+        this.libP2PNode.services.pubsub.direct.add(peer.id.toString());
+
+        return this.libP2PNode.peerStore.merge(peer.id, { multiaddrs: peer.addrs });
+      }),
+    );
+
+    this.initializedPreferredPeers = true;
+  }
+
   /**
    * Cleans up expired timeouts.
    *
@@ -149,7 +235,7 @@ export class PeerManager implements PeerManagerInterface {
    */
   private cleanupExpiredTimeouts() {
     // Clean up expired timeouts
-    const now = Date.now();
+    const now = this.dateProvider.now();
     for (const [peerId, timedOutPeer] of this.timedOutPeers.entries()) {
       if (now >= timedOutPeer.timeoutUntilMs) {
         this.timedOutPeers.delete(peerId);
@@ -157,20 +243,58 @@ export class PeerManager implements PeerManagerInterface {
     }
   }
 
+  /**
+   * Processes scheduled disconnects during heartbeat.
+   *
+   * This batch processes all peers that have been marked for disconnect.
+   * preventing immediate disconnects that could cause libp2p state corruption.
+   */
+  private async processScheduledDisconnects() {
+    if (this.peersToBeDisconnected.size === 0) {
+      return;
+    }
+
+    const peersToDisconnect = Array.from(this.peersToBeDisconnected);
+
+    this.logger.debug(`Processing ${peersToDisconnect.length} scheduled disconnects`);
+    try {
+      await Promise.all(
+        peersToDisconnect.map(async peerIdStr => {
+          if (await this.disconnectPeer(peerIdFromString(peerIdStr))) {
+            this.peersToBeDisconnected.delete(peerIdStr);
+          }
+        }),
+      );
+      this.logger.verbose(`Disconnected ${peersToDisconnect.length} peers`, { peersToDisconnect });
+    } catch (error) {
+      this.logger.error('Error when disconnecting from peers', error);
+    }
+  }
+
   /**
    * Performs Status Handshake with a connected peer.
    * @param e - The connected peer event.
    */
   private handleConnectedPeerEvent(e: CustomEvent<PeerId>) {
     const peerId = e.detail;
-    if (this.peerDiscoveryService.isBootstrapPeer(peerId)) {
-      this.logger.verbose(`Connected to bootstrap peer ${peerId.toString()}`);
-    } else {
-      this.logger.verbose(`Connected to transaction peer ${peerId.toString()}`);
+    this.logger.verbose(`Connected to peer ${peerId.toString()}`);
+    if (this.config.p2pDisableStatusHandshake) {
+      return;
     }
-    if (!this.config.p2pDisableStatusHandshake) {
+    // If we are not configured to only allow validators then perform a status handshake
+    if (!this.config.p2pAllowOnlyValidators) {
       void this.exchangeStatusHandshake(peerId);
+      return;
+    }
+
+    // We are configured to only allow validators, but this doesn't apply to trusted, private peers or preferred peers
+    if (this.isProtectedPeer(peerId)) {
+      void this.exchangeStatusHandshake(peerId);
+      return;
     }
+
+    // Initiate auth handshake
+    void this.exchangeAuthHandshake(peerId);
   }
 
   /**
@@ -179,13 +303,21 @@ export class PeerManager implements PeerManagerInterface {
    */
   private handleDisconnectedPeerEvent(e: CustomEvent<PeerId>) {
     const peerId = e.detail;
-    if (this.peerDiscoveryService.isBootstrapPeer(peerId)) {
-      this.logger.verbose(`Disconnected from bootstrap peer ${peerId.toString()}`);
-    } else {
-      this.logger.verbose(`Disconnected from transaction peer ${peerId.toString()}`);
+    this.logger.verbose(`Disconnected from peer ${peerId.toString()}`);
+    const validatorAddress = this.authenticatedPeerIdToValidatorAddress.get(peerId.toString());
+    if (validatorAddress !== undefined) {
+      this.logger.info(
+        `Removing authentication for validator ${validatorAddress} at peer id ${peerId.toString()} due to disconnection`,
+      );
+      this.authenticatedValidatorAddressToPeerId.delete(validatorAddress.toString());
+      this.authenticatedPeerIdToValidatorAddress.delete(peerId.toString());
     }
   }
 
+  public registerThisValidatorAddresses(address: EthAddress[]): void {
+    this.validatorAddresses = [...address];
+  }
+
   /**
    * Checks if a peer is trusted.
    * @param peerId - The peer ID.
@@ -239,13 +371,33 @@ export class PeerManager implements PeerManagerInterface {
     return this.privatePeers.has(peerId.toString());
   }
 
+  /**
+   * Adds a peer to the preferred peers set.
+   * @param peerId - The peer ID to add to preferred peers.
+   */
+  public addPreferredPeer(peerId: PeerId): void {
+    const peerIdStr = peerId.toString();
+
+    this.preferredPeers.add(peerIdStr);
+    this.logger.verbose(`Added preferred peer ${peerIdStr}`);
+  }
+
+  /**
+   * Checks if a peer is preferred.
+   * @param peerId - The peer ID.
+   * @returns True if the peer is preferred, false otherwise.
+   */
+  private isPreferredPeer(peerId: PeerId): boolean {
+    return this.preferredPeers.has(peerId.toString());
+  }
+
   /**
    * Checks if a peer is protected (either trusted or private).
    * @param peerId - The peer ID.
    * @returns True if the peer is protected, false otherwise.
    */
   private isProtectedPeer(peerId: PeerId): boolean {
-    return this.isTrustedPeer(peerId) || this.isPrivatePeer(peerId);
+    return this.isTrustedPeer(peerId) || this.isPrivatePeer(peerId) || this.isPreferredPeer(peerId);
   }
 
   /**
@@ -260,7 +412,7 @@ export class PeerManager implements PeerManagerInterface {
 
     this.metrics.recordGoodbyeReceived(reason);
 
-    void this.disconnectPeer(peerId);
+    this.markPeerForDisconnect(peerId);
   }
 
   public penalizePeer(peerId: PeerId, penalty: PeerErrorSeverity) {
@@ -271,6 +423,11 @@ export class PeerManager implements PeerManagerInterface {
     return this.peerScoring.getScore(peerId);
   }
 
+  public shouldDisableP2PGossip(peerId: string): boolean {
+    const isAuthenticated = this.isAuthenticatedPeer(peerIdFromString(peerId));
+    return (this.config.p2pAllowOnlyValidators ?? false) && !isAuthenticated;
+  }
+
   public getPeers(includePending = false): PeerInfo[] {
     const connected = this.libP2PNode
       .getPeers()
@@ -304,6 +461,38 @@ export class PeerManager implements PeerManagerInterface {
     return [...connected, ...dialQueue, ...cachedPeers];
   }
 
+  public isAuthenticatedPeer(peerId: PeerId): boolean {
+    const peerIdAsString = peerId.toString();
+    return (
+      this.privatePeers.has(peerIdAsString) ||
+      this.trustedPeers.has(peerIdAsString) ||
+      this.preferredPeers.has(peerIdAsString) ||
+      this.authenticatedPeerIdToValidatorAddress.has(peerIdAsString)
+    );
+  }
+
+  /*
+   * Checks whether peer is allowed to connect
+   *
+   * @param id: Address of the node or it's peerId
+   *
+   * @returns: True if node is allowed to connect, otherwise false
+   * */
+  public isNodeAllowedToConnect(id: string | PeerId): boolean {
+    const entry = this.failedAuthHandshakes.get(id.toString());
+    if (!entry) {
+      return true;
+    }
+
+    // In case entry is too old, remove it and allow connection
+    if (this.dateProvider.now() - entry.lastFailureTimestamp > FAILED_AUTH_HANDSHAKE_EXPIRY_MS) {
+      this.failedAuthHandshakes.delete(id.toString());
+      return true;
+    }
+
+    return entry.count <= this.config.p2pMaxFailedAuthAttemptsAllowed;
+  }
+
   /**
    * Discovers peers.
    */
@@ -315,12 +504,13 @@ export class PeerManager implements PeerManagerInterface {
     );
 
     // Calculate how many connections we're looking to make
-    const peersToConnect = this.config.maxPeerCount - healthyConnections.length - this.trustedPeers.size;
+    const protectedPeerCount = this.getProtectedPeerCount();
+    const peersToConnect = this.config.maxPeerCount - healthyConnections.length - protectedPeerCount;
 
     const logLevel = this.heartbeatCounter % this.displayPeerCountsPeerHeartbeat === 0 ? 'info' : 'debug';
     this.logger[logLevel](`Connected to ${healthyConnections.length + this.trustedPeers.size} peers`, {
       discoveredConnections: healthyConnections.length,
-      protectedConnections: this.trustedPeers.size,
+      protectedConnections: protectedPeerCount,
       maxPeerCount: this.config.maxPeerCount,
       cachedPeers: this.cachedPeers.size,
       ...this.peerScoring.getStats(),
@@ -342,13 +532,14 @@ export class PeerManager implements PeerManagerInterface {
         .filter(Boolean) as string[],
     );
 
+    const now = this.dateProvider.now();
     for (const [id, peerData] of this.cachedPeers.entries()) {
       // if already dialling or connected to, remove from cache
       if (
         pendingDials.has(id) ||
         healthyConnections.some(conn => conn.remotePeer.equals(peerData.peerId)) ||
         // if peer has been in cache for the max cache age, remove from cache
-        Date.now() - peerData.addedUnixMs > MAX_CACHED_PEER_AGE_MS
+        now - peerData.addedUnixMs > MAX_CACHED_PEER_AGE_MS
       ) {
         this.cachedPeers.delete(id);
       } else {
@@ -377,6 +568,10 @@ export class PeerManager implements PeerManagerInterface {
     return connections.filter(conn => !this.isProtectedPeer(conn.remotePeer));
   }
 
+  private getProtectedPeerCount(): number {
+    return this.trustedPeers.size + this.privatePeers.size + this.preferredPeers.size;
+  }
+
   private pruneUnhealthyPeers(connections: Connection[]): Connection[] {
     const connectedHealthyPeers: Connection[] = [];
 
@@ -404,7 +599,8 @@ export class PeerManager implements PeerManagerInterface {
    * @returns The pruned list of connections.
    */
   private prioritizePeers(connections: Connection[]): Connection[] {
-    if (connections.length > this.config.maxPeerCount - this.trustedPeers.size) {
+    const protectedPeerCount = this.getProtectedPeerCount();
+    if (connections.length > this.config.maxPeerCount - protectedPeerCount) {
       // Sort the regular peer scores from highest to lowest
       const prioritizedConnections = connections.sort((connectionA, connectionB) => {
         const connectionScoreA = this.peerScoring.getScore(connectionA.remotePeer.toString());
@@ -413,7 +609,7 @@ export class PeerManager implements PeerManagerInterface {
       });
 
       // Calculate how many regular peers we can keep
-      const peersToKeep = Math.max(0, this.config.maxPeerCount - this.trustedPeers.size);
+      const peersToKeep = Math.max(0, this.config.maxPeerCount - protectedPeerCount);
 
       // Disconnect from the lowest scoring regular connections that exceed our limit
       for (const conn of prioritizedConnections.slice(peersToKeep)) {
@@ -484,15 +680,36 @@ export class PeerManager implements PeerManagerInterface {
     } catch (error) {
       this.logger.debug(`Failed to send goodbye to peer ${peer.toString()}: ${error}`);
     } finally {
-      await this.disconnectPeer(peer);
+      this.markPeerForDisconnect(peer);
     }
   }
 
-  private async disconnectPeer(peer: PeerId) {
+  /*
+   * Marks peer to be disconnected on the next heartbeat
+   * */
+  private markPeerForDisconnect(peer: PeerId) {
+    const peerIdStr = peer.toString();
+    this.logger.debug(`Scheduling peer ${peerIdStr} for disconnection`);
+    this.peersToBeDisconnected.add(peerIdStr);
+  }
+
+  /**
+   * Performs the actual disconnection of a peer.
+   * This is called during heartbeat processing to avoid immediate disconnections.
+   *
+   * @returns True if peer was disconnect, otherwise false
+   */
+  private async disconnectPeer(peer: PeerId): Promise<boolean> {
+    const peerIdStr = peer.toString();
+
     try {
       await this.libP2PNode.hangUp(peer);
+
+      this.logger.debug(`Successfully disconnected peer ${peerIdStr}`);
+      return true;
     } catch (error) {
-      this.logger.debug(`Failed to disconnect peer ${peer.toString()}`, { error: inspect(error) });
+      this.logger.warn(`Failed to disconnect peer ${peerIdStr}`, { error });
+      return false;
     }
   }
 
@@ -505,10 +722,16 @@ export class PeerManager implements PeerManagerInterface {
     const peerId = await enr.peerId();
     const peerIdString = peerId.toString();
 
+    // Don't attempt to connect to peers scheduled for disconnection
+    if (this.peersToBeDisconnected.has(peerIdString)) {
+      this.logger.trace(`Skipping peer scheduled for disconnection ${peerId}`);
+      return;
+    }
+
     // Check if peer is temporarily timed out
     const timedOutPeer = this.timedOutPeers.get(peerIdString);
     if (timedOutPeer) {
-      if (Date.now() < timedOutPeer.timeoutUntilMs) {
+      if (this.dateProvider.now() < timedOutPeer.timeoutUntilMs) {
         this.logger.trace(`Skipping timed out peer ${peerId}`);
         return;
       }
@@ -548,7 +771,7 @@ export class PeerManager implements PeerManagerInterface {
       enr,
       multiaddrTcp,
       dialAttempts: 0,
-      addedUnixMs: Date.now(),
+      addedUnixMs: this.dateProvider.now(),
     };
 
     // Determine if we should dial immediately or not
@@ -583,7 +806,7 @@ export class PeerManager implements PeerManagerInterface {
         // Add to timed out peers
         this.timedOutPeers.set(id, {
           peerId: id,
-          timeoutUntilMs: Date.now() + FAILED_PEER_BAN_TIME_MS,
+          timeoutUntilMs: this.dateProvider.now() + FAILED_PEER_BAN_TIME_MS,
         });
       }
     }
@@ -622,6 +845,11 @@ export class PeerManager implements PeerManagerInterface {
     }
   }
 
+  private async createStatusMessage() {
+    const syncSummary = (await this.worldStateSynchronizer.status()).syncSummary;
+    return StatusMessage.fromWorldStateSyncStatus(this.protocolVersion, syncSummary);
+  }
+
   /**
    * Performs status Handshake with the Peer
    * The way the protocol is designed is that each peer will call this method on newly established p2p connection.
@@ -634,30 +862,30 @@ export class PeerManager implements PeerManagerInterface {
    * */
   private async exchangeStatusHandshake(peerId: PeerId) {
     try {
-      const syncSummary = (await this.worldStateSynchronizer.status()).syncSummary;
-      const ourStatus = StatusMessage.fromWorldStateSyncStatus(this.protocolVersion, syncSummary);
+      const ourStatus = await this.createStatusMessage();
       //Note: Technically we don't have to send out status to peer as well, but we do.
       //It will be easier to update protocol in the future this way if need be.
       this.logger.trace(`Initiating status handshake with peer ${peerId}`);
-      const { status, data } = await this.reqresp.sendRequestToPeer(
-        peerId,
-        ReqRespSubProtocol.STATUS,
-        ourStatus.toBuffer(),
-      );
-      const logData = { peerId, status: ReqRespStatus[status], data: data ? bufferToHex(data) : undefined };
+      const response = await this.reqresp.sendRequestToPeer(peerId, ReqRespSubProtocol.STATUS, ourStatus.toBuffer());
+      const { status } = response;
       if (status !== ReqRespStatus.SUCCESS) {
         //TODO: maybe hard ban these peers in the future.
         //We could allow this to happen up to N times, and then hard ban?
         //Hard ban: Disallow connection via e.g. libp2p's Gater
-        this.logger.debug(`Disconnecting peer ${peerId} who failed to respond status handshake`, logData);
-        await this.disconnectPeer(peerId);
+        this.logger.debug(`Disconnecting peer ${peerId} who failed to respond status handshake`, {
+          peerId,
+          status: ReqRespStatus[status],
+        });
+        this.markPeerForDisconnect(peerId);
         return;
       }
 
+      const { data } = response;
+      const logData = { peerId, status: ReqRespStatus[status], data: data ? bufferToHex(data) : undefined };
       const peerStatusMessage = StatusMessage.fromBuffer(data);
       if (!ourStatus.validate(peerStatusMessage)) {
         this.logger.debug(`Disconnecting peer ${peerId} due to failed status handshake.`, logData);
-        await this.disconnectPeer(peerId);
+        this.markPeerForDisconnect(peerId);
         return;
       }
       this.logger.debug(`Successfully completed status handshake with peer ${peerId}`, logData);
@@ -666,10 +894,134 @@ export class PeerManager implements PeerManagerInterface {
       this.logger.debug(`Disconnecting peer ${peerId} due to error during status handshake: ${err.message ?? err}`, {
         peerId,
       });
-      await this.disconnectPeer(peerId);
+      this.markPeerForDisconnect(peerId);
     }
   }
 
+  /**
+   * Performs auth Handshake with the Peer
+   * A superset of the status handshake. Also includes a challenge that needs to be signed by the peer's validator key.
+   * @param: peerId The Id of the peer to request the Status from.
+   * */
+  private async exchangeAuthHandshake(peerId: PeerId) {
+    const peerIdString = peerId.toString();
+
+    try {
+      const ourStatus = await this.createStatusMessage();
+      const authRequest = new AuthRequest(ourStatus, Fr.random());
+
+      // Note: Technically we don't have to send our status to peer as well, but we do.
+      // It will be easier to update protocol in the future this way if need be.
+      // We also need to send the challenge at least, so that the peer can sign it.
+      this.logger.debug(`Initiating auth handshake with peer ${peerId}`);
+      const response = await this.reqresp.sendRequestToPeer(peerId, ReqRespSubProtocol.AUTH, authRequest.toBuffer());
+      const { status } = response;
+      if (status !== ReqRespStatus.SUCCESS) {
+        this.logger.debug(`Disconnecting peer ${peerId} who failed to respond auth handshake`, {
+          peerId,
+          status: ReqRespStatus[status],
+        });
+        this.markAuthHandshakeFailed(peerId);
+        this.markPeerForDisconnect(peerId);
+        return;
+      }
+
+      const { data } = response;
+      const logData = { peerId, status: ReqRespStatus[status], data: data ? bufferToHex(data) : undefined };
+
+      const peerAuthResponse = AuthResponse.fromBuffer(data);
+
+      const peerStatusMessage = peerAuthResponse.status;
+      if (!ourStatus.validate(peerStatusMessage)) {
+        this.logger.debug(`Disconnecting peer ${peerId} due to failed status handshake as part of auth.`, logData);
+        this.markAuthHandshakeFailed(peerId);
+        this.markPeerForDisconnect(peerId);
+        return;
+      }
+
+      const hashToRecover = authRequest.getPayloadToSign();
+      const ethSignedHash = makeEthSignDigest(hashToRecover);
+      const sender = recoverAddress(ethSignedHash, peerAuthResponse.signature);
+      const registeredValidators = await this.epochCache.getRegisteredValidators();
+      const found = registeredValidators.find(v => v.toString() === sender.toString()) !== undefined;
+      if (!found) {
+        this.logger.debug(
+          `Disconnecting peer ${peerId} due to failed auth handshake, peer is not a registered validator.`,
+          {
+            peerId,
+            address: sender.toString(),
+          },
+        );
+        this.markAuthHandshakeFailed(peerId);
+        this.markPeerForDisconnect(peerId);
+        return;
+      }
+
+      // Check to see that this validator address isn't already allocated to a different peer
+      const peerForAddress = this.authenticatedValidatorAddressToPeerId.get(sender.toString());
+      if (peerForAddress !== undefined && peerForAddress.toString() !== peerIdString) {
+        this.logger.debug(
+          `Received auth for validator ${sender.toString()} from peer ${peerIdString}, but this validator is already authenticated to peer ${peerForAddress.toString()}`,
+        );
+        return;
+      }
+
+      this.markAuthHandshakeSuccess(peerId);
+      this.authenticatedPeerIdToValidatorAddress.set(peerIdString, sender);
+      this.authenticatedValidatorAddressToPeerId.set(sender.toString(), peerId);
+      this.logger.info(
+        `Successfully completed auth handshake with peer ${peerId}, validator address ${sender.toString()}`,
+        logData,
+      );
+    } catch (err: any) {
+      //TODO: maybe hard ban these peers in the future
+      this.logger.debug(`Disconnecting peer ${peerId} due to error during auth handshake: ${err.message ?? err}`, {
+        peerId,
+      });
+      this.markAuthHandshakeFailed(peerId);
+      this.markPeerForDisconnect(peerId);
+    }
+  }
+
+  /*
+   * Marks when peer fails auth handshake
+   * */
+  private markAuthHandshakeFailed(peerId: PeerId) {
+    const now = this.dateProvider.now();
+    const peerIdStr = peerId.toString();
+
+    const existingEntry = this.failedAuthHandshakes.get(peerIdStr);
+    this.failedAuthHandshakes.set(peerIdStr, {
+      count: (existingEntry?.count || 0) + 1,
+      lastFailureTimestamp: now,
+    });
+
+    const connections = this.libP2PNode.getConnections(peerId);
+    connections.forEach(conn => {
+      // We mark the IP address
+      const address = conn.remoteAddr.nodeAddress().address;
+      const existingAddressEntry = this.failedAuthHandshakes.get(address);
+      this.failedAuthHandshakes.set(address, {
+        count: (existingAddressEntry?.count || 0) + 1,
+        lastFailureTimestamp: now,
+      });
+    });
+  }
+
+  /*
+   * Marks when peer exchanges auth handshake
+   * Removes any failed previous attempts
+   * */
+  private markAuthHandshakeSuccess(peerId: PeerId) {
+    this.failedAuthHandshakes.delete(peerId.toString());
+
+    const connections = this.libP2PNode.getConnections(peerId);
+    connections.forEach(conn => {
+      const address = conn.remoteAddr.nodeAddress().address;
+      this.failedAuthHandshakes.delete(address);
+    });
+  }
+
   /**
    * Stops the peer manager.
    * Removing all event listeners.
@@ -686,6 +1038,54 @@ export class PeerManager implements PeerManagerInterface {
     this.libP2PNode.removeEventListener(PeerEvent.CONNECTED, this.handlers.handleConnectedPeerEvent);
     this.libP2PNode.removeEventListener(PeerEvent.DISCONNECTED, this.handlers.handleDisconnectedPeerEvent);
   }
+
+  private shouldTrustWithIdentity(peerId: PeerId): boolean {
+    return this.isProtectedPeer(peerId);
+  }
+
+  /**
+   * Performs auth request verification from peer. An auth request is valid if requested by an authorized peer (a peer we trust).
+   *
+   * @param: _authRequest - Auth request (unused)
+   * @param: peerId - The ID of the peer that requested the auth handshake
+   *
+   * @returns: StatusMessage if peer is trusted
+   *
+   * @throws: If peer is unauthorized
+   * */
+  public async handleAuthRequestFromPeer(_authRequest: AuthRequest, peerId: PeerId): Promise<StatusMessage> {
+    if (!this.shouldTrustWithIdentity(peerId)) {
+      this.logger.warn(`Received auth request from untrusted peer ${peerId.toString()}`);
+      throw new Error('Unauthorised');
+    }
+    this.logger.debug(`Received auth request from trusted peer ${peerId.toString()}`);
+    return await this.createStatusMessage();
+  }
+
+  private async updateAuthenticatedPeers(): Promise<void> {
+    const registeredValidators = await this.epochCache.getRegisteredValidators();
+    const validatorSet = new Set(registeredValidators.map(v => v.toString()));
+
+    const peersToDelete: Set<string> = new Set();
+    const addressesToDelete: Set<string> = new Set();
+    for (const [peer, address] of this.authenticatedPeerIdToValidatorAddress.entries()) {
+      const addressString = address.toString();
+      if (!validatorSet.has(addressString)) {
+        peersToDelete.add(peer);
+        addressesToDelete.add(addressString);
+        this.logger.info(
+          `Removing authentication for peer ${peer.toString()} at address ${addressString} due to no longer being a registered validator`,
+        );
+      }
+    }
+
+    for (const peer of peersToDelete) {
+      this.authenticatedPeerIdToValidatorAddress.delete(peer);
+    }
+    for (const address of addressesToDelete) {
+      this.authenticatedValidatorAddressToPeerId.delete(address);
+    }
+  }
 }
 
 /**