Hi!
I’ve been working on Secure Instant Messaging module and I have add new modes to work. Probably I will release a minor version with only this new changes.
At this moment, PenTBox 1.2 version only has the Base64-based mode. Obviously, it is not secure at all … is a PoC, a prototype.
Here I give you the description of all modes that probably will be in this future release. Extracted from the .rb file that is being developed:
——————————–
// Secure Instant Messaging // # Description.
This program is a direct instant messaging room creator between client and server, without Microsoft servers, or something like that.
- Base64 based encoding -> Is the first implementation used in the protocol, and it is so INsecure. Is not recommended for use, only for study purposes.
- GOST encryption -> A cipher designed and used in the past by the USSR, very secure.
This mode uses an encryption key by default. It is very comfortable and secure, the problem is that if an attacker know that we are using PenTBox with this mode and know how it works, then probably he can decrypt the traffic. Yes, it is very paranoid but … could happen :)
- ARC4 encryption -> A good and fast cipher but not secure at all. Used in WEP and TLS/SSL.
The encryption key is defined in the connection, the server and the client must know and enter it.
- Blowfish encryption -> A cipher designed by Bruce Schneier, very strong and secure by the moment.
The encryption key is defined in the connection, the server and the client must know and enter it.
Note: In the last 3 modes, the key is sent in a SHA512 hash.
Note 2: GOST and Blowfish use CBC (Cipher Block Chaining).
——————————–
At this moment only GOST mode is finished, ARC4 and Blowfish modes are under developement.
Here a screenshot of a chat room working with GOST mode, and Wireshark sniffing the encrpted traffic:
Suggestions? Ideas? Contact me or comment ;-)
UPDATE: Finally, the Blowfish mode was remplaced by Rijndael (AES) mode. The implementation is exactly the same.
Tags: arc4, blowfish, gost, hash, im protocol, instant messaging, pentbox, secure im
