2

I was going through SSL/TLS article on wikipedia. It turns out that it provides key setup, encryption as well as authentication. The question is "isn't this enough to make a secure messaging/chat application between two or multiple parties?"

Please correct me if I am wrong or incomplete.

  • 1
    Why do you believe otherwise? – iAdjunct Jun 22 '16 at 3:18
3

SSL establishes a secure connection channel between you (the client) and the web server. If your only worry is about someone sniffing your traffic and reading your communications, then this is good enough.

However, this implies that you must place your trust in the web server. Your chats will be stored here (e.g. HTTPS protected conversations in Google Hangouts). However, this also means that your messages can be read by the server.

What end-to-end encryption (e.g. WhatsApp) gives you is that only the involved parties can access the details of a communication, not even the provider (more details). Session setup now requires keys that only the two parties know, without any trusted source (e.g. in SSL, the browser trusts the root).

The situation gets even more complex for group chats (see discussion here). Now you need all parties involved to agree to a key, and you may want to revoke and create new keys every time group membership changes.

  • 1
    Signal protocol's double ratchet makes the communication forward secure with every round-trip, which would not be the case with peer to peer tls which would negotiate a shared session key only once and then send subsequent messages using resumption and same key. – Z.T. Jun 22 '16 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.