New API function: Publickey functions

[HelloZeroNet]

• userPublickey -> return: Get user's publickey delivered from privatekey
• userDecrypt encrypted_text -> return: Decrypted text using current user's privatekey
• cryptEncrypt publickey, text -> return: Encrypted text
• Implement API commands
• Static prototype of the site
• Welcome/Registration screen
• Register user's publickey
• Send message
• List incoming messages
• List sent messages
• Mark new, unread messages
• Contact list
• Faux delete from incoming folder
• Echo bot for testing the service
• Later: Message thread list

[HelloZeroNet]

Problems:

• the current library does not support encrypting / decrypting, so have to find an another for this task
• Is it secure to use the same private key for signing and encrypting? https://bitcointalk.org/index.php?topic=374085.msg4004761#msg4004761

[TheNain38]

It would be cool, I was going to ask for something like this to send encrypted messages between other users, so it would be possible to exchange data directly to someone without others knowing the content

[alxbob]

Which library is this? I think a basic public key / private key ability embedded in zeronet will be very useful for a lot of projects

In bip 32 we can have private public keys pairs easily i think and use this unique keys per user for encrypting/decrypting and message signing

[HelloZeroNet]

I successfully encrypted/decrypted texts using bitcoin private/publickeys, the speeds (the lib using c based openssl):

OpenSSL init 0.40299987793sec
Encrypt 100x... 1.45700001717sec
Decrypt 100x... 0.694000005722sec

If we want to hide the message recipient (and probably we do) then we have to try to decode all messages that is going through the system.
To do this efficiently we have to mark and cache messages that we have already checked. So we need a zeronet built-in cache system (probably sqlite based) that is multi-user friendly or we can store the messages in browser's localstorage.

[TheNain38]

@HelloZeroNet Cool :)

[alxbob]

Neat :) I dont know what library did you use but we can use bitmessage too for text encryption.

[HelloZeroNet]

For experimentation I tried javascript based encrypt/decrypt solution (bitcore), but it's around 80x times slower, so it's not really an option.
pure-python implementation (bitcoin-encrypt) 20x slower

[HelloZeroNet]

After doing some research encrypting using only the ecc public key (bitmessage method) is not secure eg.: https://www.reddit.com/r/Bitcoin/comments/2ntpvh/bitcrypt_encryption_with_bitcoin_addresses/cmhmny9

So I changed the code from eccEncypt(text) to:
eccEnrypt("ZNE1" + aes_key + aes_iv + aesEncrypt(aes_key, aes_iv, text))

(similar to electrum's encryption, but without hmac)

The encryption/decryption speed is similar, but it's add + 276 bytes to every message.

It would be nice if someone with more experience in this field give some advice if its a good way to encrypt messages like this.

[alxbob]

https://github.com/yann2192/pyelliptic we can use this library. It is cryptografically secure

[HelloZeroNet]

The 'cryptografically secure' is not depends on library, but the algorithm.

[alxbob]

This library is used by bitmessage and it is secure. The link on reddit you post is about bitcrypt library not pyelliptic. Actually you can talk to atheros directly i did that he is very helpful

[HelloZeroNet]

The crypto API commands are implemented:

• cryptEncrypt(text, publickey) -> Encrypt a text using the public key, Return: Encrypted text using base64 encoding
• cryptDecrypt(encrypted_text, privatekey) -> Decrypt a text using the private key, Return: Decrypted text
• userPublickey() -> Returns user's public key unique to site, Return: Public key
• userDecrypt(encrypted_text) -> Decrypt a text using the user's site unique private key, Return: Decrypted text
• userDecryptBatch(encrypted_texts) -> Decrypt a list of texts using the user's site unique private key, Return: List of decrypted texts

In the next weeks i'm going to create the messaging site to see if its works correctly, then release the plugin