4 ms·

Every peer is identified by a curve25519 public key. To add someone as a friend, you add that public key. Connections between friends are encrypted. http://na

Every peer is identified by a curve25519 public key. To add someone as a friend, you add that public key. Connections between friends are encrypted. http://nacl.cr.yp.to/box.html http://nacl.cr.yp.to/box.html is the crypto used. https://github.com/irungentoo/toxcore/blob/master/docs/Tox_middle_level_network_protocol.txt#L39 https://github.com/irungentoo/toxcore/blob/master/docs/Tox_m... describes the protocol used to connect securely to friends after they find themselves. This protocol has PFS, message padding to prevent length based leaking and should be immune against replay attacks. What makes it secure is that you know the long term public key of your friends making it really easy for the software to establish secure connections to them.

nly 12y ago
Are IP addresses encrypted in the DHT?
- irungentoo 12y ago
  Instead of doing things like encrypting ips, peers have temporary DHT public keys. The only way to get the ip of someone from their Tox id is by knowing their public DHT key which they will only send you if they are your friend. How this works is described in detail: https://github.com/irungentoo/toxcore/blob/master/docs/Prevent_Tracking.txt https://github.com/irungentoo/toxcore/blob/master/docs/Preve...
  - Byzantine 12y ago
    So basically, everybody who gives out their Tox ID on 4chan is also giving out their IP address. Great.
    - irungentoo 12y ago
      No. They have to be friends with you.
      - Byzantine 12y ago
        But you don't have to actually know them. If they posted their Tox ID on 4chan, which happens all the time, and they accept my friend request, I would have their IP address, correct?
        tokenizerrr 12y ago
        How else would you connect to them in decentralized fashion? Your IP address isn't really useful information anyway. Note that being friends in this context means the users have added each other.
        1ris 12y ago
        You could implement onion routing. But yes, you are right the IP address is usually a useless piece of information.
        tokenizerrr 12y ago
        True, but for VOIP that is guaranteed to be terribly slow.
        JoeAltmaier 12y ago
        Ip addresses change. Sometimes they don't even work for P2P. Without ICE or something its hard to even know your public IP address programmatically. So often some kind of proxy or server is necessary for most people. True decentralized connections are a sketchy proposition.
  - deleted 12y ago
    [deleted]
  - gcb0 12y ago
    this sounds insane. but im not familiar with all the concepts. it seems that now instead of alice and bob exposing their real keys, you have node a, b, c and d exposing theirs during bob handshake... which will lead to sociopath nodes that wont be part of this, but rely on nodes that accepts it for them. also, if the message is encrypted, why not use a "torrent" of all the messages being shared and discarded after a while (no need for offline messages anyway) and each node decrypts its own as they please but relay all of them in the same stream? no way to know who could decode it. and it was delivered to everyone. much like a bitcoin transaction, but without the metadata. it would probably be vulnerable to a dos by flooding it with bogus, expensive to try to read, requests... but will be the most reliable and private you can get

nly 12y ago

Are IP addresses encrypted in the DHT?

irungentoo 12y ago
Instead of doing things like encrypting ips, peers have temporary DHT public keys. The only way to get the ip of someone from their Tox id is by knowing their public DHT key which they will only send you if they are your friend. How this works is described in detail: https://github.com/irungentoo/toxcore/blob/master/docs/Prevent_Tracking.txt https://github.com/irungentoo/toxcore/blob/master/docs/Preve...
- Byzantine 12y ago
  So basically, everybody who gives out their Tox ID on 4chan is also giving out their IP address. Great.
  - irungentoo 12y ago
    No. They have to be friends with you.
    - Byzantine 12y ago
      But you don't have to actually know them. If they posted their Tox ID on 4chan, which happens all the time, and they accept my friend request, I would have their IP address, correct?
      - tokenizerrr 12y ago
        How else would you connect to them in decentralized fashion? Your IP address isn't really useful information anyway. Note that being friends in this context means the users have added each other.
        1ris 12y ago
        You could implement onion routing. But yes, you are right the IP address is usually a useless piece of information.
        tokenizerrr 12y ago
        True, but for VOIP that is guaranteed to be terribly slow.
      - JoeAltmaier 12y ago
        Ip addresses change. Sometimes they don't even work for P2P. Without ICE or something its hard to even know your public IP address programmatically. So often some kind of proxy or server is necessary for most people. True decentralized connections are a sketchy proposition.
- deleted 12y ago
  [deleted]
- gcb0 12y ago
  this sounds insane. but im not familiar with all the concepts. it seems that now instead of alice and bob exposing their real keys, you have node a, b, c and d exposing theirs during bob handshake... which will lead to sociopath nodes that wont be part of this, but rely on nodes that accepts it for them. also, if the message is encrypted, why not use a "torrent" of all the messages being shared and discarded after a while (no need for offline messages anyway) and each node decrypts its own as they please but relay all of them in the same stream? no way to know who could decode it. and it was delivered to everyone. much like a bitcoin transaction, but without the metadata. it would probably be vulnerable to a dos by flooding it with bogus, expensive to try to read, requests... but will be the most reliable and private you can get