4 ms·

I'm trying to figure out what chat method is considered superior. What about Matrix? Should I use that or Signal?

by Bromskloss 10y ago

NobleSir 10y ago
Would also love to hear a point-by-point comparison of the two..
- CiPHPerCoder 10y ago
  It looks like it uses Olm, which aspired to be an early implementation of the Signal protocol (when it was called Axolotl): https://matrix.org/git/olm/about/ https://matrix.org/git/olm/about/ I've not audited their implementation, but at least that one design choice is sane. IIRC there were some design changes between the early Axolotl ratchet and the Signal Protocol. If you're interested in using Olm, I would make "find out what the differences are and why" my first priority.
  - NobleSir 10y ago
    Ah ok I'm not necessarily so much interested in using it, but have been looking into the details of the signal ratchet recently, and was wondering what the specific changes / rationale..
    - CiPHPerCoder 10y ago
      If I had the time, I'd do a thorough analysis of the two and publish my findings.
tptacek 10y ago
The premise of the article --- and it's a good premise --- is that the secure chat applications you should consider are those that implement Signal Protocol. Matrix does not.
- vonklaus 10y ago
  do you have any resources for building a secure chat application, or maybe more accurately, implementing secure chat as a feature of an application?
  - CiPHPerCoder 10y ago
    That's not an undertaking that should be taken lightly. At minimum, you should have a team wherein one of the people making the final design decisions is a cryptography expert. And I don't mean "I learned how to do textbook RSA in college", I mean more of, "Can tease a previously undiscovered cache-timing side-channel out of a crypto library". (For example, the recent libgcrypt advisories.) If the words "padding oracle" or acronyms like AEAD sound strange and foreign, that person is not qualified to fill that role. I would wager most developers lack the background to make a messaging service that is actually secure. (To anyone reading this: Please don't let this fact magnify any sense of impostor syndrome you may have. You're far from alone. Even the experts won't embark on this endeavor without peer review.)
    - vonklaus 10y ago
      to be clear, I was hoping to build it casually on top of a protocol or library. I would not be planning on rolling my own crypto or anything like that. I want a feature of my application to be encrypted chat which given the large availability or apps & libraries, I was hoping could be more of an integration than a build out.
      - CiPHPerCoder 10y ago
        In that case, the Signal protocol is open source. https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-java https://github.com/WhisperSystems/libsignal-protocol-java More generally (i.e. not for messaging apps), libsodium is great for application-layer cryptography: https://download.libsodium.org/doc/bindings_for_other_languages/index.html https://download.libsodium.org/doc/bindings_for_other_langua...

I'm trying to figure out what chat method is considered superior. What about Matrix? Should I use that or Signal?

NobleSir 10y ago

Would also love to hear a point-by-point comparison of the two..

CiPHPerCoder 10y ago
It looks like it uses Olm, which aspired to be an early implementation of the Signal protocol (when it was called Axolotl): https://matrix.org/git/olm/about/ https://matrix.org/git/olm/about/ I've not audited their implementation, but at least that one design choice is sane. IIRC there were some design changes between the early Axolotl ratchet and the Signal Protocol. If you're interested in using Olm, I would make "find out what the differences are and why" my first priority.
- NobleSir 10y ago
  Ah ok I'm not necessarily so much interested in using it, but have been looking into the details of the signal ratchet recently, and was wondering what the specific changes / rationale..
  - CiPHPerCoder 10y ago
    If I had the time, I'd do a thorough analysis of the two and publish my findings.

tptacek 10y ago

The premise of the article --- and it's a good premise --- is that the secure chat applications you should consider are those that implement Signal Protocol. Matrix does not.

vonklaus 10y ago
do you have any resources for building a secure chat application, or maybe more accurately, implementing secure chat as a feature of an application?
- CiPHPerCoder 10y ago
  That's not an undertaking that should be taken lightly. At minimum, you should have a team wherein one of the people making the final design decisions is a cryptography expert. And I don't mean "I learned how to do textbook RSA in college", I mean more of, "Can tease a previously undiscovered cache-timing side-channel out of a crypto library". (For example, the recent libgcrypt advisories.) If the words "padding oracle" or acronyms like AEAD sound strange and foreign, that person is not qualified to fill that role. I would wager most developers lack the background to make a messaging service that is actually secure. (To anyone reading this: Please don't let this fact magnify any sense of impostor syndrome you may have. You're far from alone. Even the experts won't embark on this endeavor without peer review.)
  - vonklaus 10y ago
    to be clear, I was hoping to build it casually on top of a protocol or library. I would not be planning on rolling my own crypto or anything like that. I want a feature of my application to be encrypted chat which given the large availability or apps & libraries, I was hoping could be more of an integration than a build out.
    - CiPHPerCoder 10y ago
      In that case, the Signal protocol is open source. https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-java https://github.com/WhisperSystems/libsignal-protocol-java More generally (i.e. not for messaging apps), libsodium is great for application-layer cryptography: https://download.libsodium.org/doc/bindings_for_other_languages/index.html https://download.libsodium.org/doc/bindings_for_other_langua...