3

Not so long ago, I was chatting with a friend on our university's accounts, and the discussion went to an interesting subject: what if the administrators have access to our messages?

So we had the idea to encrypt .txt files using some software (7zip for example) and send these files through hangouts securely.

An idea would be to encrypt the file with my key then send it, my friend would encrypt it with his key then send it back to me, I decrypt the file with my key then send it back to my friend who would finally be able to read the contents of the file. The problem here is that the order of encryption keys matters for 7zip's encryption algorithm, so step 3 would fail, because only the last used key can be used for decryption.

So, is there a workaround? (pretty sure there is, cryptography does magic), and is there some simple utility to do such a thing maybe without manually bothering about the details?
Thanks.

2

This is the typical issue with encryption: the trouble is not how to securely encrypt a file but rather how to handle the encryption keys.

Basically, you have several options:

  • Use a secure channel to exchange the encryption key. It could also be a less than secure channel that you just hope isn't intercepted by anyone monitoring you line (SMS, for instance)
  • Use a method to securely agree on a common secret to use as encryption key (for instance, manually performing a Diffie-Hellman key exchange although you'll have to make sure no one can actually modify your exchange since DH isn't authenticated).
  • Use a public/private key system (for instance, PGP) to each generate a key pair and exchange your public keys in your chat room. Again, you should watch for anyone having the ability to change the traffic each of you see because they could perfom a MITM against you (in this case, i suggest using a different channel to confirm your keys. PGP makes it easy by having a key fingerprint that is much shorter than the actual key.

In practice, I would go for PGP and confirm each key over phone (it's hard to intercept and harder to fake if you know your interlocutor). Once you have exchanged keys, you can transfer any number of file using the same keys so it's actually pretty practical.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.