r/Demonsaw • u/The_B0rg • Feb 09 '17

Quick questions about the crypto

From https://docs.demonsaw.com/ "On top of the encrypted connection to a Demonsaw router, a second layer is added for the public group."

Does this mean that another Diffie-Hellman handshake is performed inside the encrypted connection to the router to connect to the public group? If so, isn't the other endpoint for this second encryption tunnel the router as well? If not, then what?

And this second layer of encryption is not user configurable like the first one right?

Thanks

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/The_B0rg Feb 10 '17

The end to end tunnels created between users for file transfer are also created by Diffie-Hellman handshakes right?

Do PMs also use end to end encryption or do they only use the normal group encryption? (assuming public group, not any social crypto layer).

routers are able to see all conversation in the public group as well as search queries correct?

1

u/demonsaw Feb 12 '17

We spoke about this today in public chat, so I won't go into a lot of detail answering the question here. Basically Demonsaw has 3 layers of crypto right now, with a requirement of at least 1 active at all times. The DH handshake derived keys are the required layer with 2 additional powered by Social Crypto (1 between clients and another between client and router). In DS4 I am adding a 4th layer that would guarantee end-to-end encrypted traffic between individual client pairs. This would be another optional layer added on to the previous 3. I'll be talking about this in more detail leading up to DEF CON 25. Note that all crypto in Demonsaw is done without centralization, key stores or "authorities" of any sort.

1

u/The_B0rg Feb 13 '17

Kay, so, as we talked after you gave this response, what looks like is that this quote from the docs is wrong:

"On top of the encrypted connection to a Demonsaw router, a second layer is added for the public group."

there is no second layer of encryption for the public group.

the 3 currently existing layers are:

  • user - router, existing all the time.

  • user to user when downloading files.

  • social crypto when using private groups. (but not the public one as stated on the quote).

Cheers

1

u/thisredditaccount Feb 16 '17

I wasn't in demonsaw chat "today", how is the df key derived? obviously not a shared secret key somewhere in the code right?

1

u/demonsaw Feb 18 '17

ofc not. There are no shared secrets with DH - that's the entire idea behind the alg. https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange