Here's the scenario:
Alice and bob use Off-the-record messaging to communicate over IM. The have:
- Perfect forward secrecy
They communicate after authenticating, being reasonably sure of each others identity. Now a rogue party breaks into Alice's house.
Alice knows that they might want to coerce her into sending messages, or she just want to send a distress signal. Typing "Help!" won't do much good, as the attackers will realise the outside world knows of her distress.
You could imagine she might type a previously negotiated distress message ("and the flowers were lovely too"), which causes the Bob's client to pop open a message:
- Alice is in distress - do not trust the following messages until you have authenticated her identity again. She is being coerced into sending them.
But the intruders might force her away from the computer too quickly. They might also dictate messages to her, removing her capability to type the flowers-sentence.
In this scenario, what is a good way to trigger a distress signal?
Some problems we have found while chatting about it:
The coercers mustn't be able to detect that Alice is sending a distress signal. Neither by looking at her, nor by analysing network traffic. This prevents even complicated schemes, like "having all letters of the alphabet used within one minute" (also a violation of the Kerckhoffs Principle).
The signal must be designed such that it is hard to trigger by accident, since a false distress signal forces (annoying and potentially flawed) trust re-negotiation measures. And it should be a protocol that's easy to use.
- The protocol used to send messages between Alice and Bob is a well known protocol.
- The adversary is physically present with Alice.
- The adversary will allow Alice to send a message unless s/he thinks Alice is sending a distress signal.
- Alice will always be allowed to send the first message.
- The adversary will monitor the messages on the channel.
- Alice will only be allowed to send a few messages.
- The adversary dictates the content of the messages Alice sends, but not their format.
- The adversary will allow Alice to receive all remote messages.
- The adversary does not know the transmission latency between Alice and Bob.
- The channel is reliable.