3 ms·

I was reading this and I realized that under the stated conditions (two parties who trust each other during conversation; later on attacker gets full access), t

by theamk 5y ago

I was reading this and I realized that under the stated conditions (two parties who trust each other during conversation; later on attacker gets full access), there is a more practical solution: SSL-secured chat with no logging. It is not as neat cryptographically-wise, and it does not work with offline message exchange, but I think that for a lot of common cases, it has the same guarantees (confidentiality, authenticity, deniability, forward secrecy) Or am I missing something?

doomrobo 5y ago
I don't think it's deniable. The server has an identity key (which resides in its certificate) that it uses to sign its response to the client Hello message. Though I guess if you make certificates short-lived and published the privkeys it might be close to OTR
rabite 5y ago
The majority of SSL implementations do not support perfect forward secrecy in any form. The bare SSL standard itself has no room for it. You need at least TLS 1.3 to get any shot at PFS -- and then again most SSL standards allow for negotiation of at least slightly older protocols. Plain SSL is also broken by NAT transversal. There's a chat protocol that does do something very similar to what you're asking: Ricochet Refresh. Ricochet Refresh spawns a Tor hidden service and provides an API via it and no text logging. Tor's transit mechanism always has confidentiality, authenticity, deniability, and perfect forward secrecy. https://www.ricochetrefresh.net/ https://www.ricochetrefresh.net/ Unfortunately there are no mobile clients for this.
XorNot 5y ago
OTR is designed to make proving authenticity of someone intercepting the message impossible: holding the message transcript means you hold all the data necessary to fake the whole thing - no one can go "look these are all signed by X's key which proves they sent them".
Lt_Riza_Hawkeye 5y ago
You'll really only get authenticity if you've exchanged certificates in some offline manner first, and eschew the whole CA infrastructure

by theamk 5y ago

doomrobo 5y ago

I don't think it's deniable. The server has an identity key (which resides in its certificate) that it uses to sign its response to the client Hello message. Though I guess if you make certificates short-lived and published the privkeys it might be close to OTR

rabite 5y ago

The majority of SSL implementations do not support perfect forward secrecy in any form. The bare SSL standard itself has no room for it. You need at least TLS 1.3 to get any shot at PFS -- and then again most SSL standards allow for negotiation of at least slightly older protocols. Plain SSL is also broken by NAT transversal. There's a chat protocol that does do something very similar to what you're asking: Ricochet Refresh. Ricochet Refresh spawns a Tor hidden service and provides an API via it and no text logging. Tor's transit mechanism always has confidentiality, authenticity, deniability, and perfect forward secrecy. https://www.ricochetrefresh.net/ https://www.ricochetrefresh.net/ Unfortunately there are no mobile clients for this.

XorNot 5y ago

OTR is designed to make proving authenticity of someone intercepting the message impossible: holding the message transcript means you hold all the data necessary to fake the whole thing - no one can go "look these are all signed by X's key which proves they sent them".

Lt_Riza_Hawkeye 5y ago

You'll really only get authenticity if you've exchanged certificates in some offline manner first, and eschew the whole CA infrastructure