3 ms·

Just FYI. While Bitmessage is not a fast option (anti-spam proof-of-work per message may take a couple of minutes), it is a remarkable example of a very secure

Just FYI. While Bitmessage is not a fast option (anti-spam proof-of-work per message may take a couple of minutes), it is a remarkable example of a very secure messaging tool in every aspect. Its design even gives you better privacy than Tor. More info: https://bitmessage.org https://bitmessage.org The idea behind Bitmessage is that messages are fully encrypted (including recipient's address) with per-message random DH key derived from recipient's key. Then message is transmitted to everyone in a p2p network. Every node tries to decrypt the message with its key and if it succeeds - that's the message for them. If not, it passes the message to other nodes. Propagation time is quick, but to prevent DoS, each message goes with an expensive one-time proof-of-work proportional to the message size. Another measure is artificial separation of messages and nodes in "streams" so that message is only propagated within a smaller part of the network. As network grows this will not hurt privacy, but will keep amount of data flowing around in check. Bitmessage in principle is like email (that is checked every few minutes, not seconds) rather than real-time chat. But the idea could be brought to real-time chats too if we solve DoS and bandwidth issues in a different way.

thedufer 13y ago
How do you initially learn a recipient's key? That seems to often be the problem point.
- oleganza 13y ago
  How do you learn someone's username or email? They tell it to you. Actually, in Bitmessage they tell you an "address" which is a compact hash of a pubkey. Then, p2p network uses special kind of message "what's the pubkey for this address?" which allows your client to find out the pubkey. An address looks like this: BM-orkCbppXWSqPpAxnz6jnfTZ2djb5pJKDb (this one belongs to an echo server). People who got used to Base58-encoded Bitcoin addresses will find this familiar.
foobarqux 13y ago
Is it forward secure yet?
- oleganza 13y ago
  It's not because DH key generation is not interactive. You generate a random cofactor pubkey alone, which will be used together with the recipient's privkey to produce a shared secret from which AES key is derived. So if the recipient's key is leaked, all their messages would be recoverable.
  - tptacek 13y ago
    So, that's a privacy level worse than that of OTR, right?
    - oleganza 13y ago
      It depends on the context. If your OTR is going through a central server or a compromised Tor route, adversary can learn who you are talking to. E.g. Adium OTR plugin sends encrypted messages, but identities of Alice and Bob are in the clear to NSA. Bitmessage does not do any OTR tricks (I myself do not think OTR is very important), but guarantees anonymous routing probably even better than Tor: every message is routed to everyone randomly without any particular route whatsoever. In addition, protocol can be extended to wrap messages with some random person's key, so you get double-clouded routing. So, Bitmessage might give you even better tangible privacy over Tor, while not giving any of disputable value of OTR. PS. Why I think OTR is of little value. OTR is a trick Alice uses to release signing keys after talking to Bob. Bob can retain the info on his disk and be interrogated, but Alice sort of "proves" that anyone could produce that data, so she's innocent. In other words, OTR is not about hiding any information, but about telling the court that "i was smart, you can't prove it was written by me". Logically OTR makes sense, but without being tested in court (which is not a department of logic) it's worthless. And I believe, when it comes to a trial, your adversaries will have plenty of parallel construction in addition to judge's "common sense" to invalidate any trickery that your might have employed. In other words: if you talked to Bob and his data is taken by NSA, you are doomed, with or without OTR. EDIT: I meant "deniability" part of OTR. "Perfect forward secrecy" is indeed valuable, but not implemented yet.

thedufer 13y ago

How do you initially learn a recipient's key? That seems to often be the problem point.

oleganza 13y ago
How do you learn someone's username or email? They tell it to you. Actually, in Bitmessage they tell you an "address" which is a compact hash of a pubkey. Then, p2p network uses special kind of message "what's the pubkey for this address?" which allows your client to find out the pubkey. An address looks like this: BM-orkCbppXWSqPpAxnz6jnfTZ2djb5pJKDb (this one belongs to an echo server). People who got used to Base58-encoded Bitcoin addresses will find this familiar.

foobarqux 13y ago

Is it forward secure yet?

oleganza 13y ago
It's not because DH key generation is not interactive. You generate a random cofactor pubkey alone, which will be used together with the recipient's privkey to produce a shared secret from which AES key is derived. So if the recipient's key is leaked, all their messages would be recoverable.
- tptacek 13y ago
  So, that's a privacy level worse than that of OTR, right?
  - oleganza 13y ago
    It depends on the context. If your OTR is going through a central server or a compromised Tor route, adversary can learn who you are talking to. E.g. Adium OTR plugin sends encrypted messages, but identities of Alice and Bob are in the clear to NSA. Bitmessage does not do any OTR tricks (I myself do not think OTR is very important), but guarantees anonymous routing probably even better than Tor: every message is routed to everyone randomly without any particular route whatsoever. In addition, protocol can be extended to wrap messages with some random person's key, so you get double-clouded routing. So, Bitmessage might give you even better tangible privacy over Tor, while not giving any of disputable value of OTR. PS. Why I think OTR is of little value. OTR is a trick Alice uses to release signing keys after talking to Bob. Bob can retain the info on his disk and be interrogated, but Alice sort of "proves" that anyone could produce that data, so she's innocent. In other words, OTR is not about hiding any information, but about telling the court that "i was smart, you can't prove it was written by me". Logically OTR makes sense, but without being tested in court (which is not a department of logic) it's worthless. And I believe, when it comes to a trial, your adversaries will have plenty of parallel construction in addition to judge's "common sense" to invalidate any trickery that your might have employed. In other words: if you talked to Bob and his data is taken by NSA, you are doomed, with or without OTR. EDIT: I meant "deniability" part of OTR. "Perfect forward secrecy" is indeed valuable, but not implemented yet.