wireapp/proteus

Axolotl Protocol Implementation

Wire

This repository is part of the source code of Wire. You can find more information at wire.com or by contacting [email protected].

You can find the published source code at github.com/wireapp.

For licensing information, see the attached LICENSE file and the list of third-party licenses at wire.com/legal/licenses/.

Proteus

Proteus is an implementation of the axolotl protocol (later renamed to Double Ratchet Algorithm) without header keys. It is suitable for use in asynchronous environments through its use of prekeys.

The roles of the axolotl protocol for a particular session are fixed through the use of prekeys:

• The side that obtains a prekey and uses it to initiate a session is Alice.

• The side that receives a prekey message and uses it to initiate a session is Bob.

All cryptographic primitives used in the implementation of the protocol are provided by libsodium:

• Cipher: ChaCha20

• MAC: HMAC-SHA256

• Diffie-Hellman: Curve25519

• KDF: HKDF (implementation)

For serialisation of messages, sessions and keys, CBOR is used. The precise serialisation format is described in the wiki.

proteus's Issues

session.rs try_message_keys

Hello,

I have the following question regarding this line of session.rs:

let mk = self.message_keys.remove(i).unwrap();

According to Rust's documentation remove() removes an element from a VecDeque and returns it. To my understanding a check for InvalidSignature should happen before removing the item from the VecDeque. Please correct me If I am wrong.

Explain pros/cons of no header keys?

Very cool project! Congratulations on making what (I think) is the first Rust axolotl implementation! I see that it's slightly different, and was wondering if the README could elaborate on what exactly that difference implies?

message timer per conversation/group

I believe that setting timed messages per user is potential security problem. I'd rather set a timer per conversation or group.
Otherwise sensitive replies might be accidentally sent without timer.

Update sodiumoxide to ^0.2.5

See the Rust security advisory: https://rustsec.org/advisories/RUSTSEC-2019-0026.html. This should be followed up with new releases of the cryptobox libraries and everything on top.

Consider switching to `ring` instead of using FFI for ed25519 keys

There might be a reason for the FFI, but I'm opening this as I was just skimming the code and it seemed reasonable.

Remove unnecessary dependencies

There are 2 in my opinion unnecessary dependencies in proteus.

The first one is the libc-crate which is only used to get the c_int-type. However this is completely unnecessary because the c_int-type is also defined in the std-crate: std::os::raw::c_int.
If you'd replace this dependency in "internal/ffi.rs" you could omit the entire libc-crate.
(I've done this; it also passes all tests on macOS.)

The second one is the byteorder-crate which is also used to serialize one u32 as big-endian.

And thank you very much that you make your software open-source under the GPL 😄

compiled failed with sodiumoxide 0.1.0

error[E0308]: mismatched types
--> /root/.cargo/git/checkouts/proteus-c72aed2360065c51/cda560b/src/lib.rs:28:5
|
27 | pub fn init() -> bool {
| ---- expected bool because of return type
28 | sodiumoxide::init()
| ^^^^^^^^^^^^^^^^^^^ expected bool, found enum std::result::Result
|
= note: expected type bool
found type std::result::Result<(), ()>

f-droid

I didn't find it in fdroid, is this something that is on the roadmap?