Tox Handshake Vulnerable to KCI
Hello, I found this source code confusingly written (and downright scary at times) and the [specification](https://toktok.github.io/spec) woefully underspecified and inexplicit, so it's entirely possible my understanding of the handshake is _inaccurate_. But on the off-chance that 5 minutes of source code review at 4am yielded something accurate, here is my understanding of the handshake: Peer A (Alice) has the longterm static keypair `(S_A^{pub}, S_A^{priv})`. Peer A has the session-generated ephemeral keypair `(E_A^{pub}, E_A^{priv})`. Peer B (Bob) has the longterm static keypair `(S_B^{pub}, S_B^{priv})`. Peer B has the session-generated ephemeral keypair `(E_B^{pub}, E_B^{priv})`. Message 1: A -> B ``` XAEAD(key=ECDH(S_A^{priv}, S_B^{pub}), payload=E_A^{pub}) ``` Message 2: B -> A ``` XAEAD(key=ECDH(S_B^{priv}, S_A^{pub}), payload=E_B^{pub}) ``` Session Key Derivation ``` ECDH(E_A^{priv}, E_B^{pub}) = ECDH(E_B^{priv}, E_A^{pub}) ``` Is this an accurate representation of the handshake? If so, keep reading. If not, you may safely stop reading here, close the issue, and accept my apologies for the misunderstanding. The issue is that this naive handshake is vulnerable to key-compromise impersonation, something that basically all modern authenticated key exchanges (AKEs) are designed to protect against. Concretely, the issue is that if A's longterm static private key is stolen, an attacker can impersonate anybody to A without A realizing. Let's say that Mallory, M, has
Posted by zx2c4 on Jan 13, 2017, 3:20 PM
Tags
Related issues
- [Meta] Feedback on granular control over Copilot changes
- unexpected status 401 Unauthorized issue
- [MODEL] Measurable quality regression in Claude generation 5 (Fable 5 / Opus 5 / Sonnet 5): worse nonsense detection, ~2x verbosity, under-disclosed model fallb
- [CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated s
- Video stops playing after some minutes
- [MODEL] Claude verbose code comments by default — ignores instructions to stop.
Raise real-world problems, find people facing the same issue, and discuss solutions.4,500 issues0 comments
github (Software)
[Meta] Feedback on granular control over Copilot changes
unexpected status 401 Unauthorized issue
[MODEL] Measurable quality regression in Claude generation 5 (Fable 5 / Opus 5 / Sonnet 5): worse nonsense detection, ~2x verbosity, under-disclosed model fallb
[CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated s
Video stops playing after some minutes
[MODEL] Claude verbose code comments by default — ignores instructions to stop.
Scope Codex VS Code chats to the current workspace/project
Update on "Co-authored-by: Copilot" in commit messages
Tox Handshake Vulnerable to KCI
Hello, I found this source code confusingly written (and downright scary at times) and the [specification](https://toktok.github.io/spec) woefully underspecified and inexplicit, so it's entirely possible my understanding of the handshake is _inaccurate_. But on the off-chance that 5 minutes of source code review at 4am yielded something accurate, here is my understanding of the handshake: Peer A (Alice) has the longterm static keypair `(S_A^{pub}, S_A^{priv})`. Peer A has the session-generated ephemeral keypair `(E_A^{pub}, E_A^{priv})`. Peer B (Bob) has the longterm static keypair `(S_B^{pub}, S_B^{priv})`. Peer B has the session-generated ephemeral keypair `(E_B^{pub}, E_B^{priv})`. Message 1: A -> B ``` XAEAD(key=ECDH(S_A^{priv}, S_B^{pub}), payload=E_A^{pub}) ``` Message 2: B -> A ``` XAEAD(key=ECDH(S_B^{priv}, S_A^{pub}), payload=E_B^{pub}) ``` Session Key Derivation ``` ECDH(E_A^{priv}, E_B^{pub}) = ECDH(E_B^{priv}, E_A^{pub}) ``` Is this an accurate representation of the handshake? If so, keep reading. If not, you may safely stop reading here, close the issue, and accept my apologies for the misunderstanding. The issue is that this naive handshake is vulnerable to key-compromise impersonation, something that basically all modern authenticated key exchanges (AKEs) are designed to protect against. Concretely, the issue is that if A's longterm static private key is stolen, an attacker can impersonate anybody to A without A realizing. Let's say that Mallory, M, has
Comments (0)
No comments yet. Start the discussion.