Hi everyone, I am trying to create an MIT licensed OMEMO library written in Typescript and while reading the protocol some questions came up. I hope someone can answer these or help me to improve the protocol (currently 0.2 [1]).
- Version 0.2 uses the signal protocol now (sec 1.1), but as far as I know there is no "signal protocol". They split it into 4 parts: XEdDSA, X3DH, Double Ratchet and Sesame which builds the "signal protocol". I think it would be helpful to mention this and link the corresponding documents. - In the examples you often see the string BASE64ENCODED, so I assume I have to encode those values with base64. Would it not be better to mention this in the text? - Device ids are just defined (sec 4.1) as random numbers between 1 and 1^31-1. I would propose to use UUID [3] as e.g. used in XEP-0359 [4] to minimize the change of collisions even further. - The protocol requires to update your own device list prior you publish your corresponding bundle (sec 4.3). Even if the case is rare that you try to request an not yet published bundle, I think it should be handled in some way. One solution could be to change the order of announcements. - X3DH uses an ephemeral key pair [5], which is also transfered, during the AKE. Maybe I missed it in the XEP, but I found no element or some way to transfer this key. - How does the double ratchet [6] work in OMEMO? As far as I understand is the double ratchet the key derivation function of the "signal protocol". It consist of two parts: the symmetric-key ratchet and the DH ratchet. The DH ratchet ensures forward secrecy and uses fresh DH keys transfered with every message. I think section 4.5 is not covering this, so this means OMEMO has no FS, or not? - The double ratchet requires that "a MAX_SKIP constant also needs to be defined" ([6] section 3.1) to handle out-of-order messages. I think OMEMO doesn't cover this topic at all, because there are no message or chain numbers transfered ([6] section 2.6). - After I received a message tagged with the prekey attribute, the protocol (sec 4.7) requires to delete the used prekey, but how do I know which prekey was used? I think there is an additional attribute missing, which contains the used preKeyId. - According to section 4.5 we encrypt the 16 byte AES key + an authentication tag. But what is an authentication tag? The GCM spec [7] uses only additional authenticated data as input value. Is this meant by authentication tag? - X3DH uses associated data for encryption which is the concatenation of both identity values. Is associated data the same as the authentication tag or the additional authenticated data? - I would love to see some security consideration for the management or audit of own devices or device keys. E.g. I think it would be helpful to attach some optional attributes to the bundle like last day of use or client vendor/name, so people can decide if they want to delete an entry. To conclude I am wondering how clients like ChatSecure, Conversations, Gajim and some more were able to implement this protocol, but maybe I just don't understand some parts of the protocol and as I said it would be awesome if someone could help me. Best regards, Klaus [1] https://xmpp.org/extensions/xep-0384.html [2] https://signal.org/docs/ [3] http://tools.ietf.org/html/rfc4122 [4] https://xmpp.org/extensions/xep-0359.html [5] https://signal.org/docs/specifications/x3dh/#sending-the-initial-message [6] https://signal.org/docs/specifications/doubleratchet/ [7] http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Standards mailing list Info: https://mail.jabber.org/mailman/listinfo/standards Unsubscribe: [email protected] _______________________________________________
