Assuming you have a "typical" group chat-room, with n participants connected together by a server (the server handles message routing).

Would be a good security schema which would allow for encrypted communication between all parties assuming the server is not "trustworthy"... or rather, assuming that the server will always do the routing correctly (it's up to the participants to figure out if there is a "Stranger" in the conversation) but it's not trust worthy in the sense that it can try decrypting the contents of the communication ?

  • $\begingroup$ what is the thread model? Could be identity of participants verified before establishing the communication through the server (e.g. by certificate or public key exchange) or you assume communication only through the server? could the server only read the data or it may try to modify them? $\endgroup$ – gusto2 Oct 6 '17 at 20:28
  • $\begingroup$ The server may try to modify the data (actually the server WILL modify the data, normally, by means of adding various headers). Why would the threading model matter (it's based on libevent) ? Or am I misinterpreting that term ? $\endgroup$ – George Oct 6 '17 at 20:39
  • $\begingroup$ Also, yes, assume there is a way for participants to identify themselves, but a non-cryptographic ways (e.g. assume all participants know a "keyword" unique to them which will make the rest trust them) but assume that this means of identifying oneself is not similar to a key (it can't be used to encrypt/descrypt data and it can't be used as a password to encrypted data) $\endgroup$ – George Oct 6 '17 at 20:42
  • $\begingroup$ I'd suggest to use PKI key exchange between participants (DH, ..), however without any 'cryptographic' way to identify participants the server could mount a man-in-the-middle-attack (decrypting or forging the communication). this is one of the reasons why certificates and certificate authorities are used (to assure identities outside the server) $\endgroup$ – gusto2 Oct 6 '17 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.