News for hackers. Stuff that matters.
Re:WhatsApp's Signal Protocol integration is now complete by moxie on Tuesday April 05, 2016 @12:14PM (#11431623)
> They seem to have replaced TLS/SSL between client and server with "Noise Pipes".

WhatsApp was already using a custom protocol instead of TLS. We worked with them to transition over to Noise Pipes, which has some advantages over what they were doing before. Also, we've renamed Axolotl to Signal Protocol: https://whispersystems.org/blog/signal-inside-and-out/

Re:WhatsApp's Signal Protocol integration is now complete by tptacek on Tuesday April 05, 2016 @12:35PM (#11431855)
It is killing me that you didn't rename Signal to Axolotl.
Re:WhatsApp's Signal Protocol integration is now complete by ironsides on Tuesday April 05, 2016 @03:22PM (#11433522)
If user growth and mainstream adoption are your goals then calling the product 'Signal' is the better choice by leaps and bounds.

Axolotl is cool in a techy/underground sort of way (if your into that) but completely misses the boat on being 1) Easy to spell, 2) easy to pronounce, 3) easy to understand.

Mainstream users would just say "wtf" and move on to whatsapp/telegram/facebook messenger.

Re:WhatsApp's Signal Protocol integration is now complete by aw3c2 on Tuesday April 05, 2016 @02:04PM (#11432791)
Why?

"Axolotl" at least has seriously pronunciation issues so I am glad it is not used "user-side".

Re:WhatsApp's Signal Protocol integration is now complete by tptacek on Tuesday April 05, 2016 @02:20PM (#11432959)
For my part: because "Axolotl" is one of the most widely name-dropped terms in hipster cryptography, and because it's been adopted by other projects, and because it's distinctive, and because they basically own the term. In a stroke, everyone doing secure key ratchets would have been using their product.

It's also just a cool name.

Re:WhatsApp's Signal Protocol integration is now complete by garrettr_ on Tuesday April 05, 2016 @05:26PM (#11434642)
I always liked "Axolotol" because axolotols are a type of salamander with the amazing ability to regenerate parts of their bodies (including their brains!), and the Axolotol protocol, like OTR, is "self-healing", meaning it's capable of recovering from a compromised session key (https://whispersystems.org/blog/advanced-ratcheting/).
Re:WhatsApp's Signal Protocol integration is now complete by vmasto on Wednesday April 06, 2016 @01:59AM (#11436909)
And you're spelling it wrong which pretty much validates the renaming.
Re:WhatsApp's Signal Protocol integration is now complete by david-given on Wednesday April 06, 2016 @06:52AM (#11437910)
Axolotls are also cool because they're not really a species in their own right --- they're actually just the juvenile form of a salamander. But they can breed while in their juvenile form! It's as if tadpoles could lay eggs without having to turn into frogs first.

In fact, axolotls only metamorphose into salamanders if triggered by the external environment. If you don't stimulate them in the right way, they stay axolotls. For a long time they were thought of as two different types of creature completely.

There's a story of one of the very early researchers looking at his vivarium one day and discovering that it was now full of salamanders rather than the axolotls he was expecting. I would love to have heard the conversation...

Re:WhatsApp's Signal Protocol integration is now complete by seivan on Thursday April 07, 2016 @12:33AM (#11444742)
Basically like a Pokemon.
Re:WhatsApp's Signal Protocol integration is now complete by DigitalJack on Tuesday April 05, 2016 @05:52PM (#11434833)
I thought it was a misspelling of axlotl from dune, so I had to google it. Frank Herbert must have taken his inspiration from the salamander as well, given what the axlotl tanks were for.
Re:WhatsApp's Signal Protocol integration is now complete by aw3c2 on Tuesday April 05, 2016 @03:11PM (#11433412)
Thanks and I agree about that!
Re:WhatsApp's Signal Protocol integration is now complete by jacobolus on Tuesday April 05, 2016 @02:58PM (#11433309)
Because words coming from Nahuatl are cool! (coyotl, mesquitl, tomatl, ahuacatl, etc.) See more from https://en.wikipedia.org/wiki/List_of_English_words_from_ind...

They’re distinctively spelled, don’t collide with existing search terms, often have available domains, etc. Most importantly, they anticipated the web 2.0 trend of ending words with two consonants in a row. ;)

Finally, just look at this guy: https://upload.wikimedia.org/wikipedia/commons/f/f6/AxolotlB...

Re:WhatsApp's Signal Protocol integration is now complete by derefr on Tuesday April 05, 2016 @03:07PM (#11433372)
Linguistic tangent: the common suffix on those words is interesting. Is it required for Nahuatl nouns, like the Latin -t suffix? I notice that not all the other example words on the linked page-section have it, but a large majority do.
Re:WhatsApp's Signal Protocol integration is now complete by ar-jan on Tuesday April 05, 2016 @03:53PM (#11433788)
t͡ɬ is a phoneme in Nahuatl [0] (Voiceless alveolar lateral affricate [1] if you care to hear it), which explains why many Nahuatl words have sequences of "tl". I don't know if there's a specific reason why these words end with that sound (it doesn't have to be a suffix).

Edit: yes, it's a suffix (for Classical Nahuatl): "Non-possessed nouns take a suffix called the absolutive. This suffix takes the form -tl after vowels (ā-tl, "water") and -tli after consonants [...]" ([2]).

0: https://en.wikipedia.org/wiki/Nahuatl#Phonology

1:https://en.wikipedia.org/wiki/Voiceless_alveolar_lateral_aff...

2: https://en.wikipedia.org/wiki/Classical_Nahuatl_grammar

Re:WhatsApp's Signal Protocol integration is now complete by thaumasiotes on Tuesday April 05, 2016 @05:39PM (#11434733)
> Is it required for Nahuatl nouns, like the Latin -t suffix?

I don't understand what you're thinking of here? Here are some Latin nouns, all in nominative case:

    nauta   (first declension)
    puer    (second)
    gladius (second)
    malum   (second)
    lex     (third)
    limen   (third)
    tempus  (third)
    virtus  (third)
    civitas (third)
    cornu   (fourth)
    manus   (fourth)
    res     (fifth)
I gave the nominative case, but in fact none of those nouns has any form ending in -t. The only -t suffix I know of in Latin is for third-person singular verbs.
Re:WhatsApp's Signal Protocol integration is now complete by derefr on Tuesday April 05, 2016 @07:20PM (#11435376)
Ah, sorry, yes, I meant the verbs. Originally I was going to make a comparison to nouns—nouns in Lojban, which have a -j suffix.
Re:WhatsApp's Signal Protocol integration is now complete by ekiru on Wednesday April 06, 2016 @01:04AM (#11436728)
I'm confused and am not sure if you're thinking of something else or if I'm quite misinformed about Lojban. I don't think lojban has suffixes at all (prefixes, on the other hand). For -j specifically, the only words in lojban which are permitted to end in j are names, but there it's not obligatory. Names are required to end in a consonant, but there are at least a few that are more common than j, I think.
Re:WhatsApp's Signal Protocol integration is now complete by smarinov on Thursday April 07, 2016 @12:38AM (#11444762)
FWIW `-j` is the plural suffix for all nouns and adjectives in Esperanto (not in accusative where the full generic form followed by an additional `-n`), but I don't know whether the OP had that in mind or something completely different.
Re:WhatsApp's Signal Protocol integration is now complete by thaumasiotes on Tuesday April 05, 2016 @05:34PM (#11434698)
> Because words coming from Nahuatl are cool! (coyotl, mesquitl, tomatl, ahuacatl, etc.)

> Most importantly, they anticipated the web 2.0 trend of ending words with two consonants in a row. ;)

But those words (coyote, mesquite, tomato, and avocado, unless I seriously miss my guess) all end in a vowel.

Re:WhatsApp's Signal Protocol integration is now complete by TuringTest on Wednesday April 06, 2016 @06:12AM (#11437802)
> But those words (coyote, mesquite, tomato, and avocado, unless I seriously miss my guess) all end in a vowel.

Because they were adopted by Spanish speakers. English products using these names could either adopt the Spanish form, or as the GP suggest follow the 2.0 trend and recover the original form, publishing their webpage in the East Timor .tl domain.

Re:WhatsApp's Signal Protocol integration is now complete by ge0rg on Tuesday April 05, 2016 @02:15PM (#11432901)
But it had a significantly better signal-to-noise (SCNR) ratio when looking for specifications, code and docs. The original "axolotl" term comes from a completely different domain, so it was easy to distinguish and filter for.

"Signal" in IT usually means UNIX inter-process communication.

Re:WhatsApp's Signal Protocol integration is now complete by mc32 on Tuesday April 05, 2016 @04:57PM (#11434377)
Kids would love that name because they know it as that cool looking salamander with gills (or whatever they are).
Re:WhatsApp's Signal Protocol integration is now complete by tptacek on Tuesday April 05, 2016 @05:44PM (#11434781)
Confirming this: my daughter was thrilled that there was something in my field actually called "axolotl".
Re:WhatsApp's Signal Protocol integration is now complete by coroutines on Tuesday April 05, 2016 @04:13PM (#11433954)
This thread is making me want to reread Dune.
Re:WhatsApp's Signal Protocol integration is now complete by antihero on Wednesday April 06, 2016 @05:45AM (#11437720)
For me the biggest thing is - how do we have any idea that WhatsApp is actually using this wonderful crypto tech under the hood? For example my WhatsApp is claiming my messages to my friend are encrypted, whereas his phone is claiming they are not. This is not exactly conducive to trust!
Re:WhatsApp's Signal Protocol integration is now complete by russgray on Wednesday April 06, 2016 @02:05PM (#11440525)
Mine did that for a while, then it resolved itself. Maybe it takes some time for all instances in a group to agree they are encrypted; I also think at least one of my groups marked itself encrypted after everyone in it had posted at least one comment since yesterday.
Re:WhatsApp's Signal Protocol integration is now complete by baby on Tuesday April 05, 2016 @02:12PM (#11432877)
What's the incentive of not using TLS?
Re:WhatsApp's Signal Protocol integration is now complete by rakoo on Tuesday April 05, 2016 @02:42PM (#11433159)
It's easy to shoot yourself in the foot with TLS (see: OpenSSL). Also, TLS has roots in a time where we knew much less in terms of crypto; as time went on and flaws were discovered, SSL/TLS was patched all around, meaning it has become much harder to implement correctly.

Noise starts from a clean state with modern knowledge of cryptography and modern cryptography. Much easier to understand and replicate, much harder to shoot yourself in the foot with.

TLS brings modularity and evolutivity, much needed in a protocol the scale of HTTP. In Whatsapp's case, Whatsapp controls both the server and the client; it is much easier to transition between versions because all bricks are under control. When you don't need what TLS brings anymore it makes sense to discard it.

As another example: Tarsnap (https://www.tarsnap.com/) uses spiped (https://www.tarsnap.com/spiped.html), a very simple yet powerful mechanism to build an encrypted channel. Its protocol and proof fit in ~100 lines (https://github.com/Tarsnap/spiped/blob/master/README). When you don't need all the jazz provided by TLS (and when you're lucky enough to be able to pre-share keys, which helps a lot) then a simple protocol is good.

Re:WhatsApp's Signal Protocol integration is now complete by makomk on Tuesday April 05, 2016 @03:56PM (#11433815)
It looks like Noise leaves an implementer with more than enough rope to hang themselves with - for example, it allows unauthenticated Diffie-Hellman, it appears to permit user-selected handshake sequences, has 16(!) different official handshake sequences with subtly different properties, each of which allow payloads to be attached to any message in the handshake process that in turn have different levels of reduced security, etc.
Re:WhatsApp's Signal Protocol integration is now complete by tptacek on Tuesday April 05, 2016 @04:22PM (#11434043)
You're describing Noise. WhatsApp uses Noise Pipes, which is one of many instances of the Noise framework.

You're right that it's not a good idea for generalists to pick up Noise and go to town with it. Noise isn't misuse-proof.

Re:WhatsApp's Signal Protocol integration is now complete by lmm on Wednesday April 06, 2016 @06:37AM (#11437867)
> You're right that it's not a good idea for generalists to pick up Noise and go to town with it. Noise isn't misuse-proof.

Nor is SSL. Couldn't an opinionated SSL library (supporting exactly one protocol version, one cipher only, etc) provide the same simplicity of use while remaining interoperable and reusing an already-validated protocol?

Re:WhatsApp's Signal Protocol integration is now complete by tptacek on Wednesday April 06, 2016 @07:46AM (#11438086)
Simplicity of use isn't the only benefit they get from Noise Pipes; they also get increased security, in a couple of important ways.

It's not the choice I would have made, but I am not as good as Moxie or Trevor.

Re:WhatsApp's Signal Protocol integration is now complete by rakoo on Wednesday April 06, 2016 @09:40AM (#11438675)
FYI there is an RFC (currently a draft) for a suite of parameters considered secure for some time, ie some kind of LTS: https://tools.ietf.org/html/draft-gutmann-tls-lts-02

The idea is more or less what you want, hardcode some known-good configuration for servers that can't or won't be upgraded every other month.

Re:WhatsApp's Signal Protocol integration is now complete by wolf550e on Wednesday April 06, 2016 @01:25PM (#11440217)
That appears to not fully interoperate with regular TLS implementations, and does not require the use of the most popular secure ciphersuite ECDHE_RSA_AESGCM. If they need to make changes to make it secure, define an extension and say this profile makes the extension mandatory (like MAC-then-encrypt), but don't just change the protocol.
Re:WhatsApp's Signal Protocol integration is now complete by tptacek on Wednesday April 06, 2016 @10:46AM (#11439088)
This is less a practical draft and more a political statement about the author's dislike for TLS 1.3. In particular, it makes extensive modifications to the TLS protocol itself (it doesn't merely propose a limited set of safe parameters).
Re:WhatsApp's Signal Protocol integration is now complete by baby on Tuesday April 05, 2016 @04:40PM (#11434197)
> It's easy to shoot yourself in the foot with TLS

I would argue it's easier to shoot yourself in the face trying to re-implement/re-design something like TLS.

Re:WhatsApp's Signal Protocol integration is now complete by rakoo on Wednesday April 06, 2016 @08:32AM (#11438298)
The mind behind Noise (Trevor Perrin) is one of the minds behind Axolotl (actually Noise can be seen as a generalization of the Axolotl's cross-signing of DH keys, see this post: https://whispersystems.org/blog/simplifying-otr-deniability/) so I would likely be comfortable with it. Although it is completely true that it's been far less used and studied than TLS.
Re:WhatsApp's Signal Protocol integration is now complete by quotemstr on Wednesday April 06, 2016 @04:29AM (#11437454)
The OP's point is that it is like TLS, except with a novelty effect. Personally, I prefer that everyone standardize than use a hundred different crypto protocols, none of which receives adequate scrutiny. TLS1.3, with encrypt-then-MAC and zero-RTT setup, can't get here fast enough.
Re:WhatsApp's Signal Protocol integration is now complete by mahyarm on Tuesday April 05, 2016 @02:25PM (#11433016)
About 6 round trips, which gives you about a 30s latency on EDGE networks. Doing a key exchange once, retaining it and then doing future communications with just 1 round trip is significantly faster.
Re:WhatsApp's Signal Protocol integration is now complete by jd20 on Tuesday April 05, 2016 @02:41PM (#11433154)
Isn't a full TLS handshake 6 messages (thus 3 round trips)? Also with false start and resumption, TLS can also typically achieve 1 roundtrip, right? (I'm also confused by 30s latency for 6 RTT, but maybe I"m too focused on US market, where EDGE latency would be more like 500ms each way.)

Maybe not all of WhatsApp's platforms support the latest TLS improvements though, thus it's easier to roll their own?

Re:WhatsApp's Signal Protocol integration is now complete by jd20 on Tuesday April 05, 2016 @02:31PM (#11433057)
I'm curious about this too. Short of some rigid technical requirement, it's hard to imagine why you'd want to reinvent the wheel or forgo a protocl which is so widely available and studied. (Although I've not read the Noise whitepaper though, I'm sure it must have some benefits compared to TLS.)
Re:WhatsApp's Signal Protocol integration is now complete by mike_hearn on Tuesday April 05, 2016 @12:22PM (#11431718)
Thanks.

As an aside, what's with Nietzsche? He seems to crop up in your screenshots quite frequently.

Re:WhatsApp's Signal Protocol integration is now complete by defen on Tuesday April 05, 2016 @01:33PM (#11432475)
"The individual has always had to struggle to keep from being overwhelmed by the tribe. If you try it, you will be lonely often, and sometimes frightened. But no price is too high to pay for the privilege of owning yourself."

(just a guess)

Re:WhatsApp's Signal Protocol integration is now complete by ianmiers on Tuesday April 05, 2016 @02:02PM (#11432781)
Is there any documentation on the old custom protocol?
Re:WhatsApp's Signal Protocol integration is now complete by andersen1488 on Tuesday April 05, 2016 @03:23PM (#11433532)
What exactly is wrong with TLS? Why the switch?
Re:WhatsApp's Signal Protocol integration is now complete by KingMob on Tuesday April 05, 2016 @09:32PM (#11435965)
As a protocol, it's quite old, complex, and has a huge surface area for attacks. E.g., the Wikipedia page (https://en.wikipedia.org/wiki/Transport_Layer_Security#Attac...) lists over a dozen major attacks against TLS/SSL. Its only advantage is ubiquity; it's the standard in every browser and web server.
Re:WhatsApp's Signal Protocol integration is now complete by mtgx on Tuesday April 05, 2016 @01:19PM (#11432333)
Moxie, what do you say to this?

https://twitter.com/JZdziarski/status/717399098563891200

Is that true? Are the messages decrypted server-side for iOS users?

Re:WhatsApp's Signal Protocol integration is now complete by narrowrail on Tuesday April 05, 2016 @02:23PM (#11432979)
This post illustrates how silly it is to link to a tweet, and not just paste the text of the message directly. This tweet has been deleted.

And for anyone else that hates visiting these social networks, Moxie's reply was, "I'm sure, but it'd be to everyone's benefit for you to verify."

Re:WhatsApp's Signal Protocol integration is now complete by dewey on Tuesday April 05, 2016 @01:51PM (#11432668)