I'm working on a chat system and I want to add it some kind of security (not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools). Now, my knowledge in cryptography is scarse, but I'm willing to learn, providing what I'm asking is possible to do:
Taking in account there's an eavesdropper (client C) bypassing HTTPS in the beginning of all connections (say a MITM, proxy, firewall, etc), and that I have my own concepts, this is the procedure I have in mind:
- The user's password is hashed locally and that hash is sent to verify it is the same in the server. If it is, continue (say, DEADBEEF).
- So now I have a public key (a123456789b) and a private key (DEADBEEF). I can use both to encrypt a message and send it.
- The client B connects to the server and gets the same public key (a123456789b) and gets another hash (since his password is different, say, FACEFEED).
- The client B receives a message from client A, and...
Here's my show-stopper: Whatever B receives, C can see it AND replay it since it has the public key and the hash (and by replaying I mean replaying the data instead of submitting the requests to my server again (which would invalidate them, obviously)).
As I see it, it doesn't matter if the message can be decrypted with either DEADBEEF (if it is sent along with the encrypted message) or with FACEFEED, since C is watching the whole protocol and can decrypt what B receives (but not what it sends?)
I'm stumped here. I know that C can hack the client code injecting its own public key or functions, but it will only receive and send garbage to the other side. If that's so, I'm happy with that because then I can show a warning and whatnot. What worries me is how do I avoid C to replay the packets and then decrypt the messages, since to decrypt it I need the public key and either FACEFEED or DEADBEEF, and those 3 are sent over the same channel?
Any help is welcome! please remember I don't know much of cryptography, I've been wandering through a lot of wikipedia links, (DH key exchange, PFS, MTProto, etc) but only understood around 50% of them all and this is what I came up with but now I need some help.