4 ms·

Can we get a quick summary of the whole crypto system?

by kaoD 4y ago

jstanley 4y ago
It says: > The URL generated contains an ECC curve25519 ciphertext (wrapped in AES simply to throw off SIGINT) that contains an armored version of the public key corresponding to the provided private key. People can visit this custom link and enter their message to encrypt it only for your eyes. I don't quite understand the idea behind wrapping the ciphertext in AES, with a constant key of "123NSA". The implementation is pretty short: https://www.pubkey.pm/index.js https://www.pubkey.pm/index.js
- kaoD 4y ago
  The AES wrapping is exactly what prompted me to ask for an explanation :) That confused me too. I'm also wondering about using a vendored OpenPGP JS instead of WebCrypto, not sure if there's a reason but I'm wary since it increases the attack surface. EDIT: Also confused about the multi-key encryption and ZKP mentions.
  - popcalc 4y ago
    >Also confused about the multi-key encryption and ZKP mentions. For scaffolding, I built upon a very cool PoC in its own right. https://zkmulticrush.github.io https://zkmulticrush.github.io I've cleaned up the references to ZKP etc. My insomniac eyes didn't catch it. Edit: The git repo has all the diffs between the two projects.
- popcalc 4y ago
  >wrapping the ciphertext in AES, with a constant key of "123NSA". Posting the public key URLs publicly was a big part of the use case I imagined. It's well known that armored PGP text gets immediately swallowed up by all kinds of actors scraping the internet. Public keys are valuable metadata and can come in handy ten years down the line for an intelligence org. The AES thing is nowhere near a solution, but a tiny bandaid.
  - makeworld 4y ago
    IMO this site should not allow key upload, forcing users to use ephemeral keys generated by the website, so they're only ever used for this purpose. Then you don't need to worry about them being public and can do away with the AES encryption. This is a cool site though, nice work!

Can we get a quick summary of the whole crypto system?

by kaoD 4y ago

Can we get a quick summary of the whole crypto system?

It says: > The URL generated contains an ECC curve25519 ciphertext (wrapped in AES simply to throw off SIGINT) that contains an armored version of the public key corresponding to the provided private key. People can visit this custom link and enter their message to encrypt it only for your eyes. I don't quite understand the idea behind wrapping the ciphertext in AES, with a constant key of "123NSA". The implementation is pretty short: https://www.pubkey.pm/index.js https://www.pubkey.pm/index.js

kaoD 4y ago
The AES wrapping is exactly what prompted me to ask for an explanation :) That confused me too. I'm also wondering about using a vendored OpenPGP JS instead of WebCrypto, not sure if there's a reason but I'm wary since it increases the attack surface. EDIT: Also confused about the multi-key encryption and ZKP mentions.
- popcalc 4y ago
  >Also confused about the multi-key encryption and ZKP mentions. For scaffolding, I built upon a very cool PoC in its own right. https://zkmulticrush.github.io https://zkmulticrush.github.io I've cleaned up the references to ZKP etc. My insomniac eyes didn't catch it. Edit: The git repo has all the diffs between the two projects.
popcalc 4y ago
>wrapping the ciphertext in AES, with a constant key of "123NSA". Posting the public key URLs publicly was a big part of the use case I imagined. It's well known that armored PGP text gets immediately swallowed up by all kinds of actors scraping the internet. Public keys are valuable metadata and can come in handy ten years down the line for an intelligence org. The AES thing is nowhere near a solution, but a tiny bandaid.
- makeworld 4y ago
  IMO this site should not allow key upload, forcing users to use ephemeral keys generated by the website, so they're only ever used for this purpose. Then you don't need to worry about them being public and can do away with the AES encryption. This is a cool site though, nice work!