Re:Firestr: encrypted P2P chat and Lua application platform
by green7ea on Saturday April 25, 2015 @04:02PM
(#9439410)
I was looking into making a similar application a while ago and was really interested in OTR. Not only does it provide encryption and authentication, it also provides deniability. Have you guys looked into using it? If you have and rejected it, what were the reasons?
[ Parent
| on HN ]
Re:Firestr: encrypted P2P chat and Lua application platform
by mempko on Saturday April 25, 2015 @04:10PM
(#9439429)
OTR is definately an inspiration here. I need to add the HMAC signing and key ratcheting. When I started there was no good OTR implementation that I could find.I was also concerned with performance. I am looking to use telehash now. What is your opinion of telehash vs stock OTR?
Re:Firestr: encrypted P2P chat and Lua application platform
by green7ea on Saturday April 25, 2015 @04:56PM
(#9439539)
I wasn't too familiar with telehash until you mentioned it. I read the docs and it looks like it's a pretty complete framework whereas OTR is more of a handshake to establish a secure channel. If you're only using telehash to secure a channel it seems like overkill. If you use its peer resolution and asynchronous messaging features it seems pretty nice.
libotr is a very good implementation of OTR (in c) [1]. I don't think performance would be a big issue on modern hardware. OTR does offer future deniability in case one of the parties gets compromised. I didn't see the same guaranty in telehash (I might have missed it).
I think they are both fine platforms but I'm far from being an expert. For anyone who is interested in the documentation I was referring to: telehash [2] and OTR [3].
[1]https://otr.cypherpunks.ca/index.php#downloads [2]https://github.com/telehash/telehash.org/blob/master/v3/spec... [3]https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html