{
  "id": 709912,
  "guid": "7c09baef-9120-5eb2-866b-b33ed4da207c",
  "logo": "/media/rc3-channels-2020/images/PWNJYW/tox_logo_Pb49JGb.png",
  "date": "2020-12-27T19:55:00+01:00",
  "start": "19:55",
  "duration": "00:40",
  "room": "franconian.net",
  "slug": "rc3-709912-adopting_the_noise_key_exchange_in_tox",
  "url": "https://pretalx.rc3.studio/rc3-channels-2020/talk/PWNJYW/",
  "title": "Adopting the Noise Key Exchange in Tox",
  "subtitle": "",
  "track": "franconian.net talks",
  "type": "Talk",
  "language": "en",
  "abstract": "Tox [0] is a free and open source peer-to-peer instant messaging protocol and implementation, that aims to provide secure messaging. It\u2019s intended as an end-to-end encrypted (E2EE) and distributed Skype replacement. Tox\u2019 cryptography is based on the NaCl library from Daniel J. Bernstein [1]. The cryptographic primitives for the key exchange (X25519), authentication (Poly1305) and symmetric encryption (XSalsa20) are state of the art peer-reviewed algorithms. \r\n\r\nUnfortunately Tox\u2019 authenticated key exchange (AKE) during Tox\u2019 cryptographic handshake is a \"home-brewed\" cryptographic protocol (remember: do not roll your own crypto!) and is known to be vulnerable to key compromise impersonation (KCI) attacks [2]. In this talk we will show why this vulnerability is challenging to exploit in practice. However, we will also present a fix to this vulnerability by designing and implementing a new cryptographic Tox handshake with formally-verified security properties.",
  "description": "KCI is a vulnerability of AKE protocols, which in this case could enable an attacker, who compromised the static long-term private X25519 [3] key of a Tox user Alice, to impersonate any other Tox user (with certain assumptions) to Alice (\"reverse impersonation\"). Furthermore, this would enable this attacker to perform a Man-in-the-Middle (MitM) attack and therefore tampering of exchanged messages. X25519 key pairs, that are necessary for the distributed hash table (DHT), make an actual KCI-attack more complex as suggested in the initial vulnerability report by Jason A. Donenfeld. \r\n\r\nThe Noise Protocol Framework [4] from Trevor Perrin (co-author of Signal [5]) was used to design a new KCI-resistant Tox\u2019 handshake. The Noise Protocol Framework is intended to use by protocol designers to create secure channel protocols based on Diffie-Hellman (DH) key agreement. Noise provides different handshake patterns for different use cases. These patterns define a sequence of DH operations to calculate a shared symmetric session key. The security properties of these patterns are formally verified. These security properties can include forward secrecy, identity hiding and most notably KCI-resistance. A handshake pattern is instantiated by DH functions, cipher functions and hash functions to give a concrete Noise protocol. Such Noise protocols are already used in some applications, like WireGuard VPN [6]. The Noise protocol used in Tox is Noise_IK_25519_ChaChaPoly_SHA512. \r\n\r\nThe Noise-C library from Rhys Weatherley [7] was used to implement the new AKE in c-toxcore [8]. The implementation is currently in proof-of-concept state and will be further improved. In future work, instead of using the Noise-C library, which supports most of Noise\u2019 handshake patterns and all cryptographic primitives, only the Noise protocol used in the Tox handshake will be implemented in c-toxcore. This will remove Noise-C as a dependency (i.e the only other dependency is NaCl/libsodium), reduce source lines of code and therefore reduce the attack surface. Noise also provides functions to further improve security, like session re-keying, which could also be adopted in Tox. \r\n\r\nTerminology in context of Tox: \r\n\r\n* Tox is the name of the protocol in general \r\n* The implementation of Tox is toxcore - a network library  (see [8])\r\n* The clients (using toxcore) have specific names (e.g. qTox [9]) \r\n\r\n____ \r\n\r\n* Full Master Thesis: https://pub.fh-campuswien.ac.at/obvfcwhsacc/content/titleinfo/5430137\r\n* [0] https://tox.chat/ \r\n* [1] https://nacl.cr.yp.to/ \r\n* [2] https://github.com/TokTok/c-toxcore/issues/426 \r\n* [3] https://ed25519.cr.yp.to/ \r\n* [4] https://noiseprotocol.org/ \r\n* [5] https://signal.org/docs/ \r\n* [6] https://www.wireguard.com/ \r\n* [7] https://rweather.github.io/noise-c/index.html \r\n* [8] https://github.com/TokTok/c-toxcore \r\n* [9] https://github.com/qTox/qTox",
  "recording_license": "",
  "do_not_record": false,
  "persons": [
    {
      "id": 90,
      "code": "BMFMHR",
      "public_name": "Tobias \"Tobi\" Buchberger",
      "biography": "Tobias Buchberger is a researcher at the Competence Centre for IT-Security at FH Campus Wien, where he also pursued his IT security studies. Before joining FH Campus Wien, he was working as an IT security analyst at a Viennese-based company for several years.",
      "answers": []
    }
  ],
  "links": [],
  "attachments": [],
  "room_id": "a59eb305-a580-4a42-8b1c-df3a4610998d",
  "origin": "pretalx.rc3.studio"
}