<story><title>IronPigeon - Decentralized communication protocol for sending secure messages</title><url>https://github.com/aarnott/ironpigeon</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>Is this running RSA PKCS #1 v1.5 signatures on every message, and CBC-encrypting without a MAC? It&amp;#x27;s a little hard to follow the code (the crypto specifics appear to be platform-specific).&lt;p&gt;Also, the WP8 code uses a CSPRNG for keys (good) but the insecure random number generator for IVs. Why?&lt;p&gt;Where do my peer&amp;#x27;s pubkeys come from? How are they stored? How are they validated? Do I have one per peer, or one single RSA key I send to all my peers?&lt;p&gt;How screwed am I if I lose my RSA key to an attacker? Are all my old messages now decryptable?&lt;p&gt;Exactly what happens when an RSA verification fails? What about when decryption fails?</text></comment>
<story><title>IronPigeon - Decentralized communication protocol for sending secure messages</title><url>https://github.com/aarnott/ironpigeon</url></story><parent_chain></parent_chain><comment><author>crazygringo</author><text>So how long will it be before someone comes up with a distributed decentralized solution for encrypted &amp;quot;e-mail&amp;quot;, much like a kind of BitTorrent+DHT+Tor for communications?&lt;p&gt;With some kind of intermediate &amp;quot;routing&amp;quot; where a few clients keep a message &amp;quot;online&amp;quot; until the intended recipient finally downloads it, or some kind of timeout expires?&lt;p&gt;But also supporting G-Chat-like functionality whenever both computers are online at the same time?&lt;p&gt;I mean, forget about interoperability with SMTP or existing e-mail addresses... just make it crypto-only, with client software just like BitTorrent programs like uTorrent, Transmission, Vuze, etc.</text></comment>