astrosonic / sanctuary

A secure synchronous lightweight chatroom with zero logging and total transience
GNU General Public License v3.0
54 stars 11 forks source link

Client-side password-based AES protection #46

Closed gridhead closed 4 years ago

gridhead commented 4 years ago

An extended field has been provided for password generation which is then used for a password-based AES message scrambling in the client-side. Only those clients with valid password and room identity combination would be able to descramble and read the messages. Even the server would not know what you are talking about.

This is the actual conversation which took place. aesbrw

This is the scrambled view available to the server. aeskon

Also, special care has been taken to dispose of the residual usernames, room identities and room passwords during the events of room exit, room stopping and room kick. Furthermore if all else fails, the client would scrub clean all the residual usernames, room identities and room passwords - the next time the client is loaded up. :slightly_smiling_face: