ChatSecure-iOS icon indicating copy to clipboard operation
ChatSecure-iOS copied to clipboard

A correct support of OMEMO: 12 byte for initilization vector (IV)

Open Neustradamus opened this issue 5 years ago • 9 comments

There is a problem in the code:

  • https://github.com/xsf/xeps/pull/894

Neustradamus avatar Feb 16 '20 18:02 Neustradamus

/close as fixed in 5.0.1 ?

licaon-kter avatar Feb 16 '20 20:02 licaon-kter

@licaon-kter this is not fixed

5.0.1 accepts aesgcm link with 12 byte IV

But omemo iteself still uses 16 bytes for encrypting

Dont know if it accepts all length for decrypting

lovetox avatar Feb 16 '20 20:02 lovetox

@chrisballinger: Thanks a lot!

Of course my ticket is for all products linked to ChatSecure (not only iOS) :)

Neustradamus avatar Feb 16 '20 21:02 Neustradamus

@chrisballinger: Conversations has switched: https://github.com/siacs/Conversations/commit/d6ae9d8d14cca2afb0ddc7a66c68bcb89a64ab3b

If you need help, please request here, maybe you can found devs here.

Neustradamus avatar Feb 17 '20 13:02 Neustradamus

@chrisballinger: ChatSecure needs to send OMEMO "messages" with 12 byte instead of 16. Can you look it? Thanks in advance.

Neustradamus avatar Feb 18 '20 12:02 Neustradamus

I see the update in ChatSecure, thanks @chrisballinger! It looks like the SignalProtocolC library also creates ivs and might need to be changed in sender_key.c? (I'm not sure when/if that function gets called)

iv = signal_buffer_create(derivative, 16);

ALFriedman avatar Apr 01 '20 11:04 ALFriedman

This has nothing to do with signal, OMEMO encrypts the payload with a key/iv which is later passed to signal and encrypted for the transfer.

The change does only concern the encryption of the payload, not how signal works

So this may come as a suprise, but the payload is not encrypted with signal, we encrypt the key with signal that was used to encrypt the payload

lovetox avatar Apr 01 '20 14:04 lovetox

@chrisballinger: It is good? Dino 0.2.0 has now "good" OMEMO.

Neustradamus avatar Nov 16 '20 08:11 Neustradamus

@chrisballinger: Any news about it?

Neustradamus avatar Aug 21 '21 14:08 Neustradamus