4 ms·

My main question is how are these keys generated and exchanged? Normal diffie-hellman is susceptible to man-in-the-middle attacks. You can eliminate this by a

by zentrus 14y ago

My main question is how are these keys generated and exchanged? Normal diffie-hellman is susceptible to man-in-the-middle attacks. You can eliminate this by adding public key certificates to the mix, but how would Silent Circle manage these certificates? How easy would it be to forge an encrypted text from an account? Essentially, how does the app verify that the key it is given is legit? So many questions and so little detail.

rcoh 14y ago
PAKE solves the MITM issue of Diffie Hellman, so if they went the DH route, they probably used something along those lines.
zentrus 14y ago
Actually, I found that they use ZRTP from their website. Phil Zimmerman wrote it and he is one of the SC founders. Wikipedia gives a nice overview: http://en.wikipedia.org/wiki/ZRTP http://en.wikipedia.org/wiki/ZRTP
moxie 14y ago
For the voice app, it uses ZRTP. Basically, the initiator and responder perform an ephemeral DH key agreement. Both clients then independently generate a "short authentication string" (basically just two English words) from the shared secret they negotiated, and display those two words to the caller. Both callers then read the two words to each-other, and if they're the same, they know there couldn't have been a MITM attack. In the case where there's a MITM attack, each caller would have different key material, resulting in a different SAS. The protocol uses hash commitment and other tricks to make this really work in practice. They haven't published the protocol for their chat app's encryption yet, but it sounds similar to OTR. While OTR has some nice tricks for verifying authenticity by using zero-knowledge proofs, it doesn't sound as if they have support for that sort of thing, and parties would have to make a call and read a SAS to each-other over the phone.
- jmspring 14y ago
  So voice is an iteration on Phil's Zfone product he was pushing a few years back...
  - moxie 14y ago
    Yes, although they seem to have much better marketing this time around (a good thing).
    - rdl 14y ago
      They're also doing some iOS/mobile specific tricks with Apple Push to do the key exchange (at least in the text app)

by zentrus 14y ago

rcoh 14y ago

PAKE solves the MITM issue of Diffie Hellman, so if they went the DH route, they probably used something along those lines.

zentrus 14y ago

Actually, I found that they use ZRTP from their website. Phil Zimmerman wrote it and he is one of the SC founders. Wikipedia gives a nice overview: http://en.wikipedia.org/wiki/ZRTP http://en.wikipedia.org/wiki/ZRTP

moxie 14y ago

For the voice app, it uses ZRTP. Basically, the initiator and responder perform an ephemeral DH key agreement. Both clients then independently generate a "short authentication string" (basically just two English words) from the shared secret they negotiated, and display those two words to the caller. Both callers then read the two words to each-other, and if they're the same, they know there couldn't have been a MITM attack. In the case where there's a MITM attack, each caller would have different key material, resulting in a different SAS. The protocol uses hash commitment and other tricks to make this really work in practice. They haven't published the protocol for their chat app's encryption yet, but it sounds similar to OTR. While OTR has some nice tricks for verifying authenticity by using zero-knowledge proofs, it doesn't sound as if they have support for that sort of thing, and parties would have to make a call and read a SAS to each-other over the phone.

jmspring 14y ago
So voice is an iteration on Phil's Zfone product he was pushing a few years back...
- moxie 14y ago
  Yes, although they seem to have much better marketing this time around (a good thing).
  - rdl 14y ago
    They're also doing some iOS/mobile specific tricks with Apple Push to do the key exchange (at least in the text app)