{"action":"created","issue":{"url":"https://api.github.com/repos/neuravion/mesh-chat-protocol/issues/24","repository_url":"https://api.github.com/repos/neuravion/mesh-chat-protocol","labels_url":"https://api.github.com/repos/neuravion/mesh-chat-protocol/issues/24/labels{/name}","comments_url":"https://api.github.com/repos/neuravion/mesh-chat-protocol/issues/24/comments","events_url":"https://api.github.com/repos/neuravion/mesh-chat-protocol/issues/24/events","html_url":"https://github.com/neuravion/mesh-chat-protocol/issues/24","id":155714120,"number":24,"title":"Should we be using the public key for the uid? / or, should we pass the public key along with messages?","user":{"login":"NullVoxPopuli","id":199018,"avatar_url":"https://avatars.githubusercontent.com/u/199018?v=3","gravatar_id":"","url":"https://api.github.com/users/NullVoxPopuli","html_url":"https://github.com/NullVoxPopuli","followers_url":"https://api.github.com/users/NullVoxPopuli/followers","following_url":"https://api.github.com/users/NullVoxPopuli/following{/other_user}","gists_url":"https://api.github.com/users/NullVoxPopuli/gists{/gist_id}","starred_url":"https://api.github.com/users/NullVoxPopuli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NullVoxPopuli/subscriptions","organizations_url":"https://api.github.com/users/NullVoxPopuli/orgs","repos_url":"https://api.github.com/users/NullVoxPopuli/repos","events_url":"https://api.github.com/users/NullVoxPopuli/events{/privacy}","received_events_url":"https://api.github.com/users/NullVoxPopuli/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-19T11:26:17Z","updated_at":"2016-05-19T11:47:31Z","closed_at":null,"body":"or, should the identity information be sent along with the message, unencryptedly?\r\n\r\ncurrently, the required message format is simply:\r\n\r\n```\r\n{ message: 'encrypted message' }\r\n```\r\n\r\nafter after everyone catches up with there NaCl support:\r\n\r\n```\r\n{ message: 'encrypted message', uid: 'uid-number' }\r\n```\r\n\r\nThe reason for the addition of the UID is because the NaCl algorithms require both the public key (of Bob) and the private key (of Alice), in order to decrypt (from Bob). So... if all the messages would require this, why not just use the public key in the message payload?\r\n\r\nNotes\r\n- The public key is 'public' anyway, no reason to keep it secret, (though, right now, the public key is network-only)\r\n- by sending the public key along with your payload, once the message is decrypted, you'd be able to tell who sent it (via the uid in the sender hash). This allows for a person to refresh their keys if they feel that there private key has become compromised.\r\n  - This makes me think impersonation attempts would be more likely, so we may need a way for a user to somehow have an additional signature on their message, or we keep the one public key per user thing going.\r\n\r\nthoughts? \r\n"},"comment":{"url":"https://api.github.com/repos/neuravion/mesh-chat-protocol/issues/comments/220301392","html_url":"https://github.com/neuravion/mesh-chat-protocol/issues/24#issuecomment-220301392","issue_url":"https://api.github.com/repos/neuravion/mesh-chat-protocol/issues/24","id":220301392,"user":{"login":"NullVoxPopuli","id":199018,"avatar_url":"https://avatars.githubusercontent.com/u/199018?v=3","gravatar_id":"","url":"https://api.github.com/users/NullVoxPopuli","html_url":"https://github.com/NullVoxPopuli","followers_url":"https://api.github.com/users/NullVoxPopuli/followers","following_url":"https://api.github.com/users/NullVoxPopuli/following{/other_user}","gists_url":"https://api.github.com/users/NullVoxPopuli/gists{/gist_id}","starred_url":"https://api.github.com/users/NullVoxPopuli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NullVoxPopuli/subscriptions","organizations_url":"https://api.github.com/users/NullVoxPopuli/orgs","repos_url":"https://api.github.com/users/NullVoxPopuli/repos","events_url":"https://api.github.com/users/NullVoxPopuli/events{/privacy}","received_events_url":"https://api.github.com/users/NullVoxPopuli/received_events","type":"User","site_admin":false},"created_at":"2016-05-19T11:47:31Z","updated_at":"2016-05-19T11:47:31Z","body":"Sending the public key along with the message would also help minimize the barrier to entry.\r\n\r\nCurrently (both people import):\r\n - Alice exports her identity (uid, public key, alias)\r\n - Bob exports his identity (uid, public key, alias)\r\n - they both import eachother's public keys, because prior to now, there is no other way to have gotten the public keys\r\n\r\nSuggested (only new people need to be imported):\r\n - Alice exports her identity (uid, public key, alias)\r\n - Bob imports Alice's identity\r\n - Bob sends a message to Alice (containing the public key in cleartext)\r\n - Alice receives Bob's message, and is able to decrypt it and then import Bob's derived identity from the message\r\n - Bob and Alice can now communicate freely.\r\n\r\n\r\nThis would also allow for people to automatically exchange keys if they are both connected to the Relay... which would be pretty great. I'm less in-love with the manual adding of people to the network recently.\r\n\r\nThoughts? @etkirsch @ecollis6"}}