4 ms·

do you have any resources for building a secure chat application, or maybe more accurately, implementing secure chat as a feature of an application?

CiPHPerCoder 10y ago
That's not an undertaking that should be taken lightly. At minimum, you should have a team wherein one of the people making the final design decisions is a cryptography expert. And I don't mean "I learned how to do textbook RSA in college", I mean more of, "Can tease a previously undiscovered cache-timing side-channel out of a crypto library". (For example, the recent libgcrypt advisories.) If the words "padding oracle" or acronyms like AEAD sound strange and foreign, that person is not qualified to fill that role. I would wager most developers lack the background to make a messaging service that is actually secure. (To anyone reading this: Please don't let this fact magnify any sense of impostor syndrome you may have. You're far from alone. Even the experts won't embark on this endeavor without peer review.)
- vonklaus 10y ago
  to be clear, I was hoping to build it casually on top of a protocol or library. I would not be planning on rolling my own crypto or anything like that. I want a feature of my application to be encrypted chat which given the large availability or apps & libraries, I was hoping could be more of an integration than a build out.
  - CiPHPerCoder 10y ago
    In that case, the Signal protocol is open source. https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-java https://github.com/WhisperSystems/libsignal-protocol-java More generally (i.e. not for messaging apps), libsodium is great for application-layer cryptography: https://download.libsodium.org/doc/bindings_for_other_languages/index.html https://download.libsodium.org/doc/bindings_for_other_langua...
    - vonklaus 10y ago
      thanks, I did a cursory look a little while ago and have been thinking of signal. Thanks for the resources. Will check out.

CiPHPerCoder 10y ago

That's not an undertaking that should be taken lightly. At minimum, you should have a team wherein one of the people making the final design decisions is a cryptography expert. And I don't mean "I learned how to do textbook RSA in college", I mean more of, "Can tease a previously undiscovered cache-timing side-channel out of a crypto library". (For example, the recent libgcrypt advisories.) If the words "padding oracle" or acronyms like AEAD sound strange and foreign, that person is not qualified to fill that role. I would wager most developers lack the background to make a messaging service that is actually secure. (To anyone reading this: Please don't let this fact magnify any sense of impostor syndrome you may have. You're far from alone. Even the experts won't embark on this endeavor without peer review.)

vonklaus 10y ago
to be clear, I was hoping to build it casually on top of a protocol or library. I would not be planning on rolling my own crypto or anything like that. I want a feature of my application to be encrypted chat which given the large availability or apps & libraries, I was hoping could be more of an integration than a build out.
- CiPHPerCoder 10y ago
  In that case, the Signal protocol is open source. https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-java https://github.com/WhisperSystems/libsignal-protocol-java More generally (i.e. not for messaging apps), libsodium is great for application-layer cryptography: https://download.libsodium.org/doc/bindings_for_other_languages/index.html https://download.libsodium.org/doc/bindings_for_other_langua...
  - vonklaus 10y ago
    thanks, I did a cursory look a little while ago and have been thinking of signal. Thanks for the resources. Will check out.