Users who are unable to meet in person have difficulties securely exchanging public keys. Adversaries are blocking transmission of DeltaChat QR codes and invite links. This is cheaper than MITM attacks, and a more feasible way of accomplishing mass surveillance.
I suggest the obvious: deniably disguising public keys as encrypted e-mails. I would not be surprised if there is already a standard for this somewhere.
User experience
- Alice and Bob are aware they both use Deltachat. Alice knows an e-mail address for Bob. They have a shared secret, which they can agree on by context code.*
- Alice sends Bob a steganographic invite, typing in a shared secret.
- Bob gets a nonsense e-mail. He clicks on “extract key”, and types in the shared secret.
- Alice and Bob now have an E2EE connection.
- Optionally, they verify fingerprints.
*for instance, if the shared secret is the incredibly stupid thing Alice once said to Bob about cheesegraters (which she knows he’ll remember verbatim a decade later), then Bob says “I got a message from you, but I didn’t understand part of it”, and Alice says “Oh, it’s about that incredibly stupid thing I said about cheesegraters”.
What happens
Alice’s client takes some info, say:
- The shared secret
- The addresses of sender and recipient
- The UTZ date of sending
- An arbitrary and variably-long string of padding-salt
- Alice’s public key
…and hashes it into a fixed-length string that looks like the contents of an encrypted e-mail. The client then cats this hash to the padding-salt, and uses the resulting string as the body of the fake encrypted e-mail.
Alice sends this fake encrypted e-mail to Bob.
Bob’s client runs the inverse of the hash algorithm. Crucially, this inverse algorithm should produce something that looks plausibly like a public key when you run any encrypted e-mail through it, and it should be moderately compute-intensive.
Alice and Bob rotate keys.
Mallory
Mallory, assuming she knows in advance that Alice and Bob are attempting to swap keys, could block one specific e-mail, in which case Alice and Bob could try again. Assuming Mallory also somehow knows what terribly silly thing Alice said about cheesegraters, she has one chance to launch a MITM attack.
If Mallory guesses wrong, she will be deleting a random encrypted e-mail and replacing it with one containing nonsense, which is a pretty conspicuous behaviour and will alert Alice and Bob. On a large scale, MITM attempts also have substantial costs.
Alice could also tell Bob that her key is the fifth message among eight decoy emails, upping costs further.
Making such a deniable steno hash standard adapt to future longer keys might be tricky.
