{"action":"created","issue":{"url":"https://api.github.com/repos/whereat/whereat-native/issues/25","repository_url":"https://api.github.com/repos/whereat/whereat-native","labels_url":"https://api.github.com/repos/whereat/whereat-native/issues/25/labels{/name}","comments_url":"https://api.github.com/repos/whereat/whereat-native/issues/25/comments","events_url":"https://api.github.com/repos/whereat/whereat-native/issues/25/events","html_url":"https://github.com/whereat/whereat-native/pull/25","id":145514312,"number":25,"title":"[#22] ZM | Add Encrypt/Decrypt form","user":{"login":"aepyornis","id":8505044,"avatar_url":"https://avatars.githubusercontent.com/u/8505044?v=3","gravatar_id":"","url":"https://api.github.com/users/aepyornis","html_url":"https://github.com/aepyornis","followers_url":"https://api.github.com/users/aepyornis/followers","following_url":"https://api.github.com/users/aepyornis/following{/other_user}","gists_url":"https://api.github.com/users/aepyornis/gists{/gist_id}","starred_url":"https://api.github.com/users/aepyornis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aepyornis/subscriptions","organizations_url":"https://api.github.com/users/aepyornis/orgs","repos_url":"https://api.github.com/users/aepyornis/repos","events_url":"https://api.github.com/users/aepyornis/events{/privacy}","received_events_url":"https://api.github.com/users/aepyornis/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/whereat/whereat-native/labels/crypto","name":"crypto","color":"5319e7"},{"url":"https://api.github.com/repos/whereat/whereat-native/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/whereat/whereat-native/labels/in%20qa","name":"in qa","color":"ff00ff"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/whereat/whereat-native/milestones/2","html_url":"https://github.com/whereat/whereat-native/milestones/mvp","labels_url":"https://api.github.com/repos/whereat/whereat-native/milestones/2/labels","id":1680715,"number":2,"title":"mvp","description":"the following features work and are deployed to signed packages for both iOS and Android:\r\n* users can share private, encrypted, geolocated text messages with trusted friends\r\n* users can turn location sharing on and off\r\n* users can change location-sharing interval\r\n ","creator":{"login":"aguestuser","id":6032844,"avatar_url":"https://avatars.githubusercontent.com/u/6032844?v=3","gravatar_id":"","url":"https://api.github.com/users/aguestuser","html_url":"https://github.com/aguestuser","followers_url":"https://api.github.com/users/aguestuser/followers","following_url":"https://api.github.com/users/aguestuser/following{/other_user}","gists_url":"https://api.github.com/users/aguestuser/gists{/gist_id}","starred_url":"https://api.github.com/users/aguestuser/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aguestuser/subscriptions","organizations_url":"https://api.github.com/users/aguestuser/orgs","repos_url":"https://api.github.com/users/aguestuser/repos","events_url":"https://api.github.com/users/aguestuser/events{/privacy}","received_events_url":"https://api.github.com/users/aguestuser/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":0,"state":"open","created_at":"2016-04-03T23:30:48Z","updated_at":"2016-04-04T01:40:12Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2016-04-03T16:04:48Z","updated_at":"2016-04-04T14:37:16Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/whereat/whereat-native/pulls/25","html_url":"https://github.com/whereat/whereat-native/pull/25","diff_url":"https://github.com/whereat/whereat-native/pull/25.diff","patch_url":"https://github.com/whereat/whereat-native/pull/25.patch"},"body":"* Uses default settings from sjcl for .encrypt & .decrypt\r\n* You can copy and paste encrypted text (in sjcl's json format) and it\r\n  will decrypt it"},"comment":{"url":"https://api.github.com/repos/whereat/whereat-native/issues/comments/205325247","html_url":"https://github.com/whereat/whereat-native/pull/25#issuecomment-205325247","issue_url":"https://api.github.com/repos/whereat/whereat-native/issues/25","id":205325247,"user":{"login":"aguestuser","id":6032844,"avatar_url":"https://avatars.githubusercontent.com/u/6032844?v=3","gravatar_id":"","url":"https://api.github.com/users/aguestuser","html_url":"https://github.com/aguestuser","followers_url":"https://api.github.com/users/aguestuser/followers","following_url":"https://api.github.com/users/aguestuser/following{/other_user}","gists_url":"https://api.github.com/users/aguestuser/gists{/gist_id}","starred_url":"https://api.github.com/users/aguestuser/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aguestuser/subscriptions","organizations_url":"https://api.github.com/users/aguestuser/orgs","repos_url":"https://api.github.com/users/aguestuser/repos","events_url":"https://api.github.com/users/aguestuser/events{/privacy}","received_events_url":"https://api.github.com/users/aguestuser/received_events","type":"User","site_admin":false},"created_at":"2016-04-04T14:37:15Z","updated_at":"2016-04-04T14:37:15Z","body":"If I'm thinking about it correctly (definitely could not be -- help me out here), the fact that we *store* the salt (ie: that it's the same every time and that we always hash a new message with the same salt and IV) is what leaves us open to replay attacks. If Alice always uses the same salt and IV to hash messages to Bob, then Mallory just has to grab the output of that hashing function then stick it back on the wire to fool Bob. (Which she can easily do because all clients see all messages from and send messages to all other clients in our current architecture.) She never has to guess the secret key or hash anything herself. She just sticks the same encrypted string back on the wire, and Alice thinks its from Bob. If we were talking about some normal message. \r\n\r\n(Bob tells Alice \"Hi I'm hungry\" then maybe it's no big deal. But if we're saying \"I'm at 14th and 6th.\" It matters a lot more if Mallory can fool Alice into thinking that's what Bob is saying, when Bob is in fact now at 32nd and Madison.)\r\n\r\nDefeating the ability to replay stale messages is the point of a nonce, and why it requires a round trip *before* every exchange. The server tells the client \"hey this is going to be the nonce we're going to use this time!\" The client's like \"okay, let's use it!\" Then in the *second* trip (the one where they actually exchange messages), they use a different salt then the one they used last time, and an attacker can't just send the client an old message from the server or vice versa, because the client or server would reject it as having the wrong nonce.\r\n\r\nSince we don't have the 1-to-1 line of communication required for this two-step exchange, we're a bit hard up. Off the top of my head, we could either (1) change the salt with every message and include the next salt both upon initial key exchange and with every message that goes over the wire (a \"racheting\" approach similar to what n+1 sec does), or (2) make the salt some hash of the current time, which we could send in the clear along with the polling frequency so that message recipients could detect whether the current time claimed by the message sender was within a reasonable margin of how often they communicate.\r\n\r\nOr somesuch....\r\n\r\nIn any case, does my claim that a persistent salt opens us to replay attacks make sense? Am I thinking about it right?\r\n\r\n"}}