Tendermint: consensus: do we need to sign heartbeat?

[ebuchman]

The Heartbeat message is sent by proposers if they have create_empty_blocks=false or create_empty_blocks_interval > 0, while they are waiting (either for txs or for the interval to expire).

It's only purpose is debugging. The receiver just logs the msg, but doesn't do anything else with it.
The message is signed, but we never check the signature.

Since we're not checking signatures, we probably shouldnt sign heartbeats at all, and remove all the associated code for doing so. We also probably don't want to get spammed with heartbeat messages, so perhaps we can put them behind a debug flag configuration all together?

[milosevic]

If it's only used for debugging maybe we should consider removing it completely. We should probably try to reduce number of messages exchanged as every message is opening DDoS attack. Ideally, all messages we exchange should be signed and could be part of proof of misbehaviour.

[liamsi]

I agree with @milosevic on this. If we could remove it completely this would be much cleaner and probably safer.

[ebuchman]

Closing for https://github.com/tendermint/tendermint/issues/2871

We should remove the heartbeat completely. Nodes can log the message locally - doesn't seem like there's much additional benefit to sending it to their peers.