Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does BitMessage provide key authentication? If so, then how? How would one can be sure that the public key belongs to the right person?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

From Wikipedia:

Outgoing messages contain no explicit address of the recipient of the message. Therefore, every network participant tries to decrypt every message passing through the network even if the message was not originally intended for that network participant. Since only the actual recipient can successfully decrypt the messages intended for him, all network participants know that if they fail to decrypt the message then the message was not intended for them.

From Jonathan Warren's original paper:

We propose a system where users exchange a hash of a public key that also functions as the user’s address. If the public key can be obtained by the underlying protocol, then it can easily be hashed to verify that it belongs to the intended recipient... an example address would be: BM‐2nTX1KchxgnmHvy9ntCN9r7sgKTraxczzyE.

It appears that a user's public key (or, a hash of their public key) is their messaging address. Thus, there is nothing to verify: when you send a message to user with public key P, you don't need to verify that your recipient's public key is really P, because you have identified your recipient solely by his public key.

As for how to tell if a public key belongs to a particular real-world entity: you can't, just as you can't easily verify that a particular email address belongs to a particular real-world entity.

For example, you want to send Alice a message. Alice advertises her Bitmessage address (e.g., on her business cards, on her public website, etc.) as BM‐2nTX1KchxgnmHvy9ntCN9r7sgKTraxczzyE. You make a P2P Bitmessage request to get the public key associated with BM‐2nTX1KchxgnmHvy9ntCN9r7sgKTraxczzyE. When you have fetched the key, you quickly verify that its fingerprint matches the one in Alice's address. then, you use the Bitmessage system to encrypt your message so it is readable only by Alice's private key.

But how did you know that BM‐2nTX1KchxgnmHvy9ntCN9r7sgKTraxczzyE is really Alice's address? Maybe someone printed out fake business cards, or hijacked Alice's website to change her address. Maybe so, but if they did, that's not a problem that Bitmessage is designed to solve.

In fact, the lack of connection between an address and a real-world entity seems to be branded as a feature:

Hiding one’s identity is difficult. Even if throw-away email addresses are used, users must connect to an email server to send and retrieve messages, revealing their IP address...

And when talking about broadcast messages (emphasis mine):

This would allow an individual or organization to anonymously publish content using an authenticated identity to everyone who wishes to listen.

The primary use for BitMessage (as presented in the paper, anyway) seems to be the ability to sent messages that are from a cryptographically verified source, but that source is free to avoid identifying themselves in any real-world way.

I think that something like PGP's web of trust could be implemented on top of BitMessage to provide identity verification: such authentication is not incompatible with BitMessage, but it seems to be a service that would exists independent of BitMessage (i.e., step 1: verify that BM‐2nTX1Kc... really is Alice's address; step 2: send a message to BM‐2nTX1Kc... using BitMessage).

share|improve this answer
    
Yes the email address is a hash of the public key and some other information as well. So yes, you are sure that this email address will be able to decrypt messages sent under its public key. But it doesn't tell you that the public key and thus the email address belong to the intended person (it joins your last comment). So if it's not taking into account, you have to find other way to certify a public key, like sharing it on a trusted channel. For example, Pretty Good Prviacy PGP used a web of trust to try to identify public keys. Does BitMessage have similar things ? –  Kheil Jul 23 '13 at 20:57
    
@Kheil Right, with PGP, users cryptographically sign statements like, "I assert that Bob Roberts has a public key with the fingerprint XXXXXX." As far as I can tell, Bitmessage has no similar web of trust mechanism. (Maybe one could be deployed?) I look forward to any other answers addressing the topic. –  apsillers Jul 23 '13 at 21:00
    
"But how did you know that BM‐2nTX1KchxgnmHvy9ntCN9r7sgKTraxczzyE is really Alice's address? Maybe someone printed out fake business cards, or hijacked Alice's website to change her address. Maybe so, but if they did, that's not a problem that Bitmessage is designed to solve." That's why I meant by key authentication, so for you BitMessage is not designed for that. Thank you. Let's see if others agree on that and I'll validate your answer. –  Kheil Jul 23 '13 at 21:02
    
@Kheil I read the BitMessage paper more thoroughly I've made another edit. I looks like what you want (address-to-person authentication) is not part of BitMessage, because the original author assumed a threat model in which users would not want to have their address linked to their real identities. However, such a system (if it were implemented) would not be incompatible with BitMessage, since "sending an encrypted message" and "verifying the real owner of an address" are orthogonal operations. –  apsillers Jul 24 '13 at 13:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.