otr4j / otr4j-issues

1 stars 0 forks source link

How to detect if message was transmitted securely? #9

Closed cobratbq closed 4 years ago

cobratbq commented 9 years ago

I'm not sure about this one, so I want to pose the question: How do we currently detect if a message was transmitted securely?

Some context: say you receive a message, you call transformReceiving(rawData) : String -> transformedData. Now you have transformedData.

Now, how do you know that transformedData contains content that originally came from an encrypted message?

AFAICT you cannot determine this directly, but you could determine that indirectly. Directly, you only receive a String, and this could have been handled as plaintext message or as an encrypted message. In case of plain text, you could receive the same instance (assumption) so you could determine it that way. In case this message was incorrectly transmitted in plain text, then OtrEngineHost#unencryptedMessageReceived(...) will be called before receiving the result, so indirectly you can check if that method was called. And in case it was transmitted securely, then you would get a different instance but other than that there is no indicator.

I'm not sure if we should rely on the indicator inputData == transformedData to test for plain text messages.

In my (WIP) implementation of TLV8 ( https://github.com/cobratbq/otr4j/tree/tlv8 ) I created a "container type" Message, which gets returned to the client application, which contains:

  1. message content: transformed (decryted) message content
  2. boolean flag: true for content previously encrypted, false for plain text
  3. tlv8value which contains the raw value contained in the Type 8 TLV. (See also issue https://github.com/otr4j/otr4j/issues/28 )

So, do we need this "container" type Message, or can we do without. Suggestions?