ChatSecure / ChatSecure-iOS

ChatSecure is a free and open source encrypted chat client for iOS that supports OTR and OMEMO encryption over XMPP.
https://chatsecure.org
Other
3.13k stars 1.03k forks source link

A correct support of OMEMO: 12 byte for initilization vector (IV) #1181

Open Neustradamus opened 4 years ago

Neustradamus commented 4 years ago

There is a problem in the code:

licaon-kter commented 4 years ago

/close as fixed in 5.0.1 ?

lovetox commented 4 years ago

@licaon-kter this is not fixed

5.0.1 accepts aesgcm link with 12 byte IV

But omemo iteself still uses 16 bytes for encrypting

Dont know if it accepts all length for decrypting

Neustradamus commented 4 years ago

@chrisballinger: Thanks a lot!

Of course my ticket is for all products linked to ChatSecure (not only iOS) :)

Neustradamus commented 4 years ago

@chrisballinger: Conversations has switched: https://github.com/siacs/Conversations/commit/d6ae9d8d14cca2afb0ddc7a66c68bcb89a64ab3b

If you need help, please request here, maybe you can found devs here.

Neustradamus commented 4 years ago

@chrisballinger: ChatSecure needs to send OMEMO "messages" with 12 byte instead of 16. Can you look it? Thanks in advance.

ALFriedman commented 4 years ago

I see the update in ChatSecure, thanks @chrisballinger! It looks like the SignalProtocolC library also creates ivs and might need to be changed in sender_key.c? (I'm not sure when/if that function gets called)

iv = signal_buffer_create(derivative, 16);

lovetox commented 4 years ago

This has nothing to do with signal, OMEMO encrypts the payload with a key/iv which is later passed to signal and encrypted for the transfer.

The change does only concern the encryption of the payload, not how signal works

So this may come as a suprise, but the payload is not encrypted with signal, we encrypt the key with signal that was used to encrypt the payload

Neustradamus commented 3 years ago

@chrisballinger: It is good? Dino 0.2.0 has now "good" OMEMO.

Neustradamus commented 2 years ago

@chrisballinger: Any news about it?