Request for Comments

[hackergrrl]

The Cable Protocol is a new, proposed protocol specification. It's made up of two smaller protocols: the Cable Wire Protocol and the Cable Handshake Protocol.

The purpose of the Cable Protocol is to facilitate the setup of a secure connection between two members of a cabal chat, and the creation and sync of that cabal, by allowing peers to exchange cryptographically signed documents with each other, such as chat messages, spread across various user-defined channels.

For small edits, please consider using the github feature for "suggested changes": https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/commenting-on-a-pull-request

Thank you for reviewing our work!

[keks]

Agreed, this was a nice read! I have left a few comments inline.

Regarding the version negotiation: I think right now it's not great that there is no cryptographic agreement on the major version, and I suggest using the Noise prologue to achieve it. And as long as there are no features to be negotiated, maybe it's not needed? Either way, the minor version negotiation could theoretically happen in the ciphertext now.

Regarding the paper I posted on fragmentation: I only skimmed it a long time ago, and the only thing I took away from it was "boundary-hiding is hard than just encrypting the length prefixes", because you usually can see where ciphertexts start and end by watching transmission patterns. It's definitely a vector of leakage, but when I think about what the actual concern is, then I think it boils down to fingerprinting: I see that you received a lot of ciphertexts that were the same size as that other persons, so you are likely in a chat group. If I recall correctly, the InterMAC stuff was a bit complicated to implement, so I'd understand if you consider this out of scope. But maybe you can add some padding inside the ciphertext, so messages look more uniform?

Looking forward to any follow-ups :)

Oh and yeah, no compensation please.

[hackergrrl]

@AljoschaMeyer @keks Thank you so much for your notes, wow! It's going to take me a bit to work through all of this, but I feel tremendous gratitude for y'all taking the time. 💜

[hackergrrl]

Thanks very much for the notes @RangerMauve!

[hackergrrl]

After consideration, I've decided to remove TTL from this version of the protocol. It's not yet clear that it's a necessary feature, and its removal simplifies implementation logic.

[hackergrrl]

@AljoschaMeyer @keks Hey y'all! How would you like to be credited as contributors (if at all)? If you can give me the verbatim name you'd like to use I can joyfully add it. :)

[hackergrrl]

Hey y'all! I'm going to consider feedback concluded on 8am Pacific on Wednesday April 24th, and merge in this work. :)

[AljoschaMeyer]

@AljoschaMeyer @keks Hey y'all! How would you like to be credited as contributors (if at all)? If you can give me the verbatim name you'd like to use I can joyfully add it. :)

Huh, "contributor" feels a bit strong to me. If you want to mention me (as "Aljoscha Meyer") for "providing feedback", or something along those lines, that works.

[hackergrrl]

@AljoschaMeyer

Huh, "contributor" feels a bit strong to me. If you want to mention me (as "Aljoscha Meyer") for "providing feedback", or something along those lines, that works.

For me, Contributor feels right. You definitely contributed. I see a lot of value in your comments, and the spec gained tremendously from them in my opinion. So far "Contributor" has included everyone who has contributed anything, including fixes to typos. It all counts to me!

If you still feel strongly about it though, I will of course honour your request and add an additional category for you called "Providing Feedback". 💙

[AljoschaMeyer]

In that case, "contributor" is fine for me =)

[keks]

If you feel like I contributed, I'll take it, but I don't have strong feelings either way. If you want to mention me (in whatever role), you can call me "Jan Winkelmann".

[hackergrrl]

Merged! Thank you so much y'all for your valuable time and comments. If y'all end up having thoughts re: any of the revision comments I made, please feel free to respond here still, or open a new issue.

[cblgh]

🌼🌼🌼🌼🌼🌼🌼🌼🌼🌼🌼🌼🌼🌼🌼!!!!

[AljoschaMeyer]

Woop, congratulations!