Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

github.com

Post reply on HN
Print view View original

41–47 of 47 posts

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#41

Post by sarciszewski »

Using libsodium, there are two routes you can go:

    - crypto_box() for authenticated public-key encryption
    - crypto_box_seal() for anonymous public-key encryption
      (with message authentication)
I know for a fact that there are JS bindings for libsodium.

http://doc.libsodium.org/bindings_for_other_languages/index....

For PHP developers:

https://github.com/paragonie/pecl-libsodium-doc/blob/master/...

https://github.com/paragonie/pecl-libsodium-doc/blob/master/...

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#42

Post by tptacek »

bobbywilson0 wrote: post #36
tptacek wrote: post #12

To function, both the reader and writer have to download special software. If you're going to do that, why not just have both sides download PGP?

Since I have worked on something similar, in my opinion, it isn't the downloading software that is necessarily a hurdle (although I agree that it is a bit of one); it is around the general difficulty and pain around your local setup and finding the user you are trying to contact's pgp key. This has been discussed at length, but I think it comes down to pgp being enough of a hassle that people who aren't focused on pr…

I just don't buy it. Using Github-registered SSH keys to communicate is also an idiosyncratic and complicated way to exchange messages (evidence: far, far more people use PGP than use schemes like this). It's also much less secure.

I see absolutely no win here.

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#44

Post by jlank »

tptacek wrote: post #27
jlank wrote: post #22

Earlier quoted context omitted.

Sorry I made you barf ryan-c. If you have any interest in making this better I'd be willing to convert your constructive criticism into code. Issues are open on GH :)

Can you take this as a learning experience? 1. Tools to encrypt messages using Github SSH keys are probably not a good idea. They're no more usable than real message encryption solutions, but have far more constraints. 2. You cannot safely use RSA like a normal cipher. RSA is a tool for building crypto protocols. The way you've deployed it here has a serious vulnerability. If you want to build things that use cryptog…

Absolutely a learning experience, this is why I posted it to HN. Really appreciate your feedback and everyone else's - it has been tremendous. Also thanks for the note on Nacl and libsodium, I will look into those.

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#45

Post by hardwaresofton »

jlank wrote: post #24
jlank wrote: post #21

Earlier quoted context omitted.

I ran into this issue, I couldn't encrypt really large strings so I chunked the plain text. Not sure why that is the case. I would consider doing something like what you suggest, though I'm not sure exactly how I'd implement it. If you're interested in showing me how, I'd love to collaborate on some code with you (start an issue! https://github.com/sadasystems/private-message/issues )

after reading more comments, I now have a better idea of how to achieve this. thanks again!

Hey no problem! Should I still open that issue? Seems like you have one made already (https://github.com/sadasystems/private-message/issues/5).

I ended up doing this for a project that I wanted to have use RSA for large chunks of data, for sending it was:

1. Generate random AES cipher key (I used a 16 byte key) using any available secure rng (it all depends on where the thing gets it's entropy, I think node's crypto.getRandomBytes is supposed to be strong)

2. Pad & Encrypt data with AES

3. Encrypt randomly-generated key with RSA

4. Send the message in an envelope like: {key: , data: }

For me, the devil was in the details -- padding took an especially long time for me to understand and solve (the thing I was working on was cross platform, so ruby->js or python->ruby, and of course not all implementations pad the same way), but once that was solved, most other things were easy. The node part was also particularly troubling because I had to deal with the way to specify encodings in node, which was kind of confusing (I spent a lot of time messing with base64/binary encoding and having my terminal start showing gibberish when I tried to print binary data)

I don't have access to that code now (I actually wrote it in order to get around the fact that internal networks at a certain company I used to work at didn't have a custom rootCA/support TLS properly), otherwise I'd just post it.

Would love to help with the implementation though

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#46

Post by sarciszewski »

jlank wrote: post #44
tptacek wrote: post #27

Earlier quoted context omitted.

Can you take this as a learning experience? 1. Tools to encrypt messages using Github SSH keys are probably not a good idea. They're no more usable than real message encryption solutions, but have far more constraints. 2. You cannot safely use RSA like a normal cipher. RSA is a tool for building crypto protocols. The way you've deployed it here has a serious vulnerability. If you want to build things that use cryptog…

Absolutely a learning experience, this is why I posted it to HN. Really appreciate your feedback and everyone else's - it has been tremendous. Also thanks for the note on Nacl and libsodium, I will look into those.

You won't be disappointed.

Re: Show HN: Encrypted Communication via GitHub Using Node.js and SSH Keys

#47

Post by ryan-c »

jlank wrote: post #44
tptacek wrote: post #27

Earlier quoted context omitted.

Can you take this as a learning experience? 1. Tools to encrypt messages using Github SSH keys are probably not a good idea. They're no more usable than real message encryption solutions, but have far more constraints. 2. You cannot safely use RSA like a normal cipher. RSA is a tool for building crypto protocols. The way you've deployed it here has a serious vulnerability. If you want to build things that use cryptog…

Absolutely a learning experience, this is why I posted it to HN. Really appreciate your feedback and everyone else's - it has been tremendous. Also thanks for the note on Nacl and libsodium, I will look into those.

It should probably have a big fat "I wrote this to learn, it's probably not secure" banner at the top of the readme.
Post reply on HN