News for hackers. Stuff that matters.

A comment on Tox: secure messaging for everyone. Parent comment

Re:Tox: secure messaging for everyone by irungentoo on Monday July 29, 2013 @11:46AM (#6121806)
> Nonce's are "Numbers used ONCE", they 1) don't need to be secret and 2) ARE NOT encryption keys.

We know.

Putting the nonces in the handshake along with the session public key was simple.

In the NaCl docs it is advised that if you can keep the nonces secret that you do so.

[ Parent | on HN ]
Re:Tox: secure messaging for everyone by anologwintermut on Monday July 29, 2013 @12:14PM (#6122004)
Out of curiosity, why not use OTR for messaging?
[ Parent | on HN ]
Re:Tox: secure messaging for everyone by znq on Monday July 29, 2013 @12:35PM (#6122134)
Probably because OTR only works when both parties are online at the same time.

Edit: that said I haven't looked at their solution. Maybe it has the same issues. Or worse.

[ Parent | on HN ]
Re:Tox: secure messaging for everyone by anologwintermut on Monday July 29, 2013 @12:48PM (#6122229)
Looking at their crypto code, it appears they assume both parties are online. There is a two way hand shake for key negotiation.

My guess was they wanted to handle things like video chat and file transfer that OTR doesn't handle. But at least for video chat, I don't think it NACL will work out of the box either

[ Parent | on HN ]