4
$\begingroup$

I recently discovered Tox whilst looking for alternatives to Skype, and while the Tech FAQ goes into some details about algorithms used, etc. I don't understand how keys are securely exchanged.

I understand that at least the following takes place:

  1. Asymmetric keys are used to exchange a symmetric key.
  2. Symmetric keys are used for exchange of chat messages.

From reading this question, it seems that it's not possible to establish such a communication with no prior shared information. With that being the case, it seems that the user id (which is quite long) is the only piece of information shared between clients before establishing communication through the interim untrusted server. I assume this is used in some way to prove the identity.

My question, therefore, is how are symmetric keys exchanged in such a way that the interim server can't perform a MITM attack (by presenting itself to Client A as Client B, and by presenting itself to Client B as Client A)?

If my question has been asked before, please feel free to flag it as a duplicate.

$\endgroup$
  • 1
    $\begingroup$ What all the approaches to solving this come down to is the following: You need to be sure that a given (public) key is actually associated with the physical entity you are talking to. As soon as you have this, it's "easy" to perform a secure key exchange. Note that this association can take many forms, e.g. you can check it yourself ("direct trust"), you can trust some third party to check ("hierarchical trust") it or you can trust many third parties a little to check it and hope they didn't all screw up (that's the idea behind "web-of-trust"). $\endgroup$ – SEJPM Aug 6 '18 at 10:54
3
$\begingroup$

There is no way to establish a shared key with a man in the middle attack and no trusted third party.

With a trusted third party, they can validate public keys so that the man in the middle can't send his.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.