Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XEP-0384: OMEMO version 0.4 #903

Merged
merged 49 commits into from
Mar 10, 2020
Merged

XEP-0384: OMEMO version 0.4 #903

merged 49 commits into from
Mar 10, 2020

Conversation

iNPUTmice
Copy link
Contributor

As promised three years ago we got together and created a new 'libsignal-free' iteration of the OMEMO specification. This new iteration is the result of almost five years of implementation experience. It is the combined work of Andreas Straub, Daniel Gultsch, Tim Henkes, Klaus Herberth, Paul Schaub and Marvin Wißfeld.

  • Incorporate the double ratchet protocol specification.
  • Use one node to store all bundles. One item per bundle.
  • Recommend 'open' access model for both PEP nodes.
  • Specify OMEMO encryption for XEP-0045 Multi-User Chats.
  • Use XEP-0420: Stanza Content Encryption.
  • Use AES256/CBC to encrypt SCE payload.
  • Change namespace to urn:xmpp:omemo:1
  • Use wrapping 'keys' element for key elements in 'header'.
  • Define threat model

Find a rendered version here: https://gultsch.de/files/xep-0384.html

Note to editor: Feel free to squash this into one commit.

Regarding authorship see Council Minutes from 2020-01-22.

iNPUTmice and others added 30 commits March 7, 2020 18:13
iNPUTmice and others added 19 commits March 8, 2020 17:16
Signed-off-by: Maxime “pep” Buquet <pep@bouah.net>
Signed-off-by: Maxime “pep” Buquet <pep@bouah.net>
Sessions are device-to-device relationships. When we talk about
'opting-out' we want to communicate a _preference_ for an entire account
not just on specific device-to-device relationship.

The actual double ratchet sessions will also remain intact. So it is not
reversing what ever we did in 'Starting a session' but just switching back
from omemo to plain. (When we currently do that manuelly we also wouldn’t
touch the actual underlying sessions)

I would like to note at this point that we don’t have a way of 'opting-in'
either. Nowhere do we say that a client MUST use OMEMO if they discover
that the other side has bundles. Therefor I find it strange that the opt-out
was a MUST and i weakend it to SHOULD. (we don’t say that a client SHOULD start
omemo when it discovers support either so I even find a SHOULD too strong)
@CLAassistant
Copy link

CLAassistant commented Mar 10, 2020

CLA assistant check
All committers have signed the CLA.

@Ppjet6 Ppjet6 added the Ready To Merge No acknowledgements of other parties are needed anymore. There may be changes to do at merge time. label Mar 10, 2020
@Ppjet6 Ppjet6 merged commit 54529a5 into xsf:master Mar 10, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Ready To Merge No acknowledgements of other parties are needed anymore. There may be changes to do at merge time.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants