My question is regarding the Signal Protocol. Is it possible to implement the protocol securely, without a server?
(I have no particular motivation for the question other than to understand better how the Signal Protocol works, what kind of trust I give to the server, and what attacks are possible if the server can be hacked or if server <> client communication can be monitored).
Imagine a room with a big whiteboard (or a chalkboard). This is our "server", but anyone can enter the room at any time and make any modification they want. The goal is for Alice to initiate an encrypted, asynchronous conversation with Bob by writing messages on the board.
My understanding is that neither XEdDSA/VXEdDSA nor the Double Ratchet component of the protocol are affected by the board being public. Is that correct?
That leaves the other two components of the protocol.
As stated in X3DH Section 4.7, "Server Trust", the following properties are true when using a server, and would still be true using a whiteboard:
- The server can cause communication to fail by refusing to deliver messages (someone can erase the board).
- The server can refuse to provide pre-keys, or somebody can drain pre-keys (erase them from the board), reducing forward secrecy.
What are the other attacks which would be made possible by giving anyone access to the board?
As stated in Sesame Section 6.3, "Protecting Server Communications":
If an attacker is able to impersonate a victim device when authenticating to the server, the attacker could fetch messages being sent to this device. The attacker would not be able to decrypt these messages, but would learn sender UserIDs and DeviceIDs.
This would obviously be impossible to prevent on the whiteboard, so everyone would be able to see who is communicating with whom.
Sesame also relies on server <> client communication being encrypted and authenticated. From the same section:
Communication between devices and servers should be encrypted and authenticated. This limits the amount of metadata that is exposed to eavesdroppers, and makes it harder for third-party attackers to perform active or passive attacks on device-to-device communications.
What attacks would be made possible by giving anyone access to the board?
As best I can tell, the only reduction in security comes from the fact that anyone would be able to monitor who is talking to whom.
Forward secrecy could also be reduced by eliminating pre-keys. Would that completely eliminate forward secrecy?
How could cryptographic deniability be affected?
Have any similar protocols ever been developed which would give the same properties as the Signal Protocol without trusting a server at all (e.g. you could literally do it on our whiteboard)?
Thanks, and I hope you have fun thinking about it!