Score:1

End-to-end mobile chat application

vi flag

I'm creating a mobile chat application using python (django) as backend, and I'd like to implement an end-to-end (E2E) cryptographic system for protecting messages.

Now, as I understood so far, when one of the user create the chat, the server will go to generate 2 couples of public and private key, and the next step is to exchange the public keys between the users and save locally the private ones.

Now the problem arise when the user log out of the application, or simply delete it, since the private key is not stored anywhere in the server, but only on the local memory, how can the user recover the chat?

Feel free to link me everything, because it's not so easy to found interesting things on web about it. Here's an interesting guide I followed

Thank you

Score:3
in flag

Now, as I understood so far, when one of the user create the chat, the server will go to generate 2 couples of public and private key, and the next step is to exchange the public keys between the users and save locally the private ones.

It's called a public and private key pair.

What kind of actions are performed depends entirely on the protocol.

Generally the private key is kept on the end entity device, and the public key is shared and trusted somehow on the other devices. Most chat protocols are designed in such a way that the server cannot read the messages, or pose as an end entity. That means that the private keys for the end entities are not shared with the server.

Actually, in the article you've linked it reads:

Secure private key distribution among a user’s multiple devices is not a good option.


Now the problem arise when the user log out of the application, or simply delete it, since the private key is not stored anywhere in the server, but only on the local memory, how can the user recover the chat?

Well done, you've spotted one of the main problems with encrypted chat applications.

Actually, it's a bit worse as you'd encounter the same problem when adding a device. One way of handling this is to store the private key somewhere, possibly password encrypted. It can then be imported into the device again.

That sounds fine until you would want to protect the private key into a secure key store which precludes import of the private key and - more importantly - extraction of the key. In that case you might need to create a scheme with multiple levels of keys, for instance.


In short: key management is the hard part of any cryptographic protocol.

Paul Rock avatar
vi flag
Thank you so much for your answer, So I'm going to create a PrivateKeys table and store all the private keys, encrypted using user's password, in the table, and when the user logs in I'm going to retrieve the corresponding private key. Obviously every chat instance of the same user has its own private key, so I need to create the 2 couples for every chat? ( with chat I mean the DB instance like sender=Bob and receiver=Alice ).
Maarten Bodewes avatar
in flag
Yes, every participant should have at least one key pair. It depends on the nature of the chat application how this private key is to be used though. The messages themselves are generally protected with a symmetric key, which needs to be established using the private key. Note that creating a secure chat app is even harder than creating a P2P communication protocol - don't be fooled by the apparent simplicity (message backup, delayed delivery, voice options, size and frequency analysis etc. etc.).
Paul Rock avatar
vi flag
I agree with you, and I know it's easy to be fooled, but I just need to create a very simple chat application to send only text messages and I need, for now, the easiest encrypt algorithm possible. So do you think I can what we've just talked about? Thank you again
Maarten Bodewes avatar
in flag
Yes, it is possible the way you've discussed. Note that the the password should be really strong and it is highly advised to use a PBKDF, because the server can perform an offline dictionary attack to guess the password and retrieve the private key.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.