Off-The-Record Communication, Or, Why Not to Use PGP
Total Page：16
File Type：pdf, Size：1020Kb
Off-the-Record Communication, or, Why Not To Use PGP Nikita Borisov Ian Goldberg Eric Brewer UC Berkeley Zero-Knowledge Systems UC Berkeley [email protected] [email protected] [email protected] ABSTRACT over the last decade to become the basis for a wide variety of Quite often on the Internet, cryptography is used to pro- forms of communication, ranging from electronic commerce, tect private, personal communications. However, most com- to the sharing of music and video, to social conversation. monly, systems such as PGP are used, which use long-lived Along with the growing population of the Internet came encryption keys (subject to compromise) for confidentiality, growing concern over the security of the data flowing across and digital signatures (which provide strong, and in some it. Your online communications could be observed by any jurisdictions, legal, proof of authorship) for authenticity. number of third parties on their way to their destinations. In this paper, we argue that most social communications Even data residing on your own PC could be vulnerable if online should have just the opposite of the above two prop- you were unlucky enough to open the wrong email attach- erties; namely, they should have perfect forward secrecy and ment. repudiability. We present a protocol for secure online com- The protections developed were twofold: use firewalls and munication, called “off-the-record messaging”, which has host security to lock down the endpoints, and use cryp- properties better-suited for casual conversation than do sys- tography to protect the information in transit. Popular tems like PGP or S/MIME. We also present an implemen- cryptographic systems, such as SSL [9], PGP [6, 33], and tation of off-the-record messaging as a plugin to the Linux S/MIME [4], were developed and used to protect diverse GAIM instant messaging client. Finally, we discuss how forms of data. to achieve similar privacy for high-latency communications The majority of electronic commerce is protected by SSL. such as email. What about social communication? Some of it takes place over email, for which PGP and S/MIME are common tools of protection. And an increasing portion of it uses instant Categories and Subject Descriptors messaging protocols, such as AIM [3], MSN [20], ICQ [16], K.4.1 [Management of Computing and Information and many others. To protect instant messages there are sev- Systems]: Public Policy Issues—Privacy; E.3 [Data]: Data eral alternatives. Trillian [31] was the first to have a widely Encryption; K.6.5 [Management of Computing and In- deployed solution for users of its client, called SecureIM, formation Systems]: Security and Protection—Authenti- which provided basic secrecy but no authentication. AOL cation followed with its own protocol [2], functionally similar to S/MIME. One can also use PGP in an instant-messaging General Terms code with the appropriate glue logic. [14] However, these approaches offer very different security and privacy proper- Security ties. Which is right? In this paper, we examine what kind of privacy is nec- Keywords essary for social communications. We argue that not only must encryption be used to hide the contents of the conver- Perfect Forward Secrecy, Deniability, Private Communica- sation, but also, the encryption must provide perfect forward tion secrecy to protect from future compromises. Additionally, authentication must be used to ensure that the person on 1. INTRODUCTION the other end is who they claim to be. However, the au- Originally a medium for the transfer of technical infor- thentication mechanism must offer repudiation, so that the mation, data, and research, the Internet has grown rapidly communications remain personal and unverifiable to third parties. Only with these properties can privacy similar to real-world social communications be achieved. However, none of the mechanisms currently used for so- Permission to make digital or hard copies of all or part of this work for cial communications have all of these properties. PGP and personal or classroom use is granted without fee provided that copies are S/MIME provide encryption and digital signatures, but the not made or distributed for profit or commercial advantage and that copies encryption keys are typically long-lived, and the digital sig- bear this notice and the full citation on the first page. To copy otherwise, to natures are non-repudiable. The Trillian SecureIM scheme republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. provides perfect forward secrecy, but performs no authen- WPES'04, October 28, 2004 tication at all. We therefore propose a new protocol for Copyright 2004 ACM 1-58113-968-3/04/0010 ...$5.00. protecting social interactions in the context of instant mes- properties: we want only Bob to be able to read the mes- saging. sage, and Bob should be assured that Alice was the author; In section 2 we motivate our privacy objectives. Section 3 however, no one else should be able to do either. Further, gives an overview of relevant cryptographic primitives, and after Alice and Bob have exchanged their message, it should section 4 contains an exposition of our off-the-record instant- be impossible for anyone (including Alice and Bob them- messaging protocol. In section 5 we describe our implemen- selves) to subsequently read or verify the authenticity of the tation of this protocol in a common instant messaging sys- encrypted message, even if they kept a copy of it. It is clear tem. In section 6, we consider how to achieve similar privacy that PGP does not provide these desirable properties. in the high-latency context of email. Finally, we review some This paper introduces a protocol for private social commu- related work in section 7 and in section 8 we conclude. nication which we call “off-the-record messaging”. The notion of an off-the-record conversation well-captures the se- 2. MOTIVATION mantics one intuitively wants from private communication: only the two parties involved are privy to the contents of the When Alice and Bob are talking in person, it is easy to conversation; after the conversation is over, no one (not even keep their conversation private. Alice can make sure no one the parties involved) can produce a transcript; and although is around, and, with the exception of a hidden tape recorder, the participants are assured of each other’s identities, nei- she can be reasonably sure that no one else will hear the con- ther they nor anyone else can prove this information to a versation. Further, the only evidence anyone can obtain of third party. Using this protocol, Alice and Bob can enjoy the conversation is Bob’s word about what happened. Such the same privacy in their online conversations that they do private, off-the-record conversations are common and useful when they speak in person. in both social and business contexts. There is even a recog- nized need to have similar private conversations by telephone — it is illegal to tap or record a phone conversation without 3. CRYPTOGRAPHIC PRIMITIVES the parties’ consent or a court order. In this section, we outline the cryptographic primitives we What happens when Alice and Bob want to have such a will use to achieve our goal of off-the-record communication. private conversation online? Today, being somewhat crypto- savvy, they would use PGP. Alice encrypts her messages to • Perfect forward secrecy will be used to ensure our Bob’s public encryption key, and signs them with her own past messages cannot be recovered retroactively. private signature key. That way, only Bob can read the messages, and Bob is assured that Alice is the one who sent • Digital signatures will be used so that Bob knows them. with whom he’s communicating. Unbeknownst to Alice and Bob, however, the eavesdrop- per Eve is listening (good thing they used crypto!) and • Message authentication codes will be used to prove storing all of the encrypted messages, which she can’t read. Alice’s authorship of a message to Bob, while at the Some time later, Eve manages to obtain Bob’s private key, same time preventing such a proof to third parties. for example though a black bag job [12], Magic Lantern [28], or a subpoena. Eve now can read all of Bob’s past email that • Malleable encryption will be used to provide for she’s collected over the years. In addition, Eve has evidence forgeability of transcripts, repudiation of contents, and in the form of a cryptographic digital signature that Alice plausible deniability. was the one who sent the messages. This doesn’t sound like a private conversation at all! After 3.1 Perfect forward secrecy the fact, a cryptographically verifiable transcript of Alice The most obvious feature we need from our off-the-record and Bob’s conversation has been recovered. messaging system is confidentiality: only Alice and Bob should be able to read the messages that make up their 2.1 What went wrong? online conversation. Since we assume everything transmit- You could say that Bob losing control of his private key ted over the Internet is public information, we need to use was the problem. But with today’s easily-compromised per- encryption. Now our problem is reduced to ensuring that sonal computers, this is an all-too-likely occurence. We the decryption keys for the messages never fall into hands would really prefer to be able to handle such failures grace- other than Alice’s and Bob’s. fully, and not simply give away the farm. Alice’s and Bob’s abilities to safeguard their decryption There were two main problems: keys becomes paramount.