I want my mesh networks to be signed, not encrypted
19 points by JulianSildenLanglo
19 points by JulianSildenLanglo
The former does not preclude the latter, because a protocol that can transmit any plaintext can transmit any ciphertext, requiring only manual encryption and decryption at either end. I acknowledge that there exist legal complications when it comes to the topic of whether it is legal to send encrypted messages over certain frequencies, but this remains true regardless of whether or not the protocol requires encryption. And in any case any communication channel which tolerates even the slightest amount of natural randomness can be used as a channel for transmitting encrypted messages via steganography with provably perfect plausible deniability.
I absolutely agree with this. I understand why people want their messages to be encrypted, but the kind of encryption that can be reasonably done on the tiny devices and with the low bandwidths people tend to use for this kind of mesh network is not really a very robust security barrier. Among other things, the amount of metadata that can be collected from simply listening to Meshtastic/MC networks without even trying to decrypt them is really quite immense, and with more than a few listening stations it's quite easy to get a reasonable position estimate too.
I would love to see an unencrypted, signed, ham friendly variant of LoRa mesh networks take off.
I didn't understand why you don't want encryption, AFAICT you haven't articulated that?
Good point, I should maybe clarify that a bit. There's two reasons: firstly encryption makes it a lot harder to operate legally on amateur radio bands. Secondly it stifles comms as it inherently limits them to people who are invited to the comms channel.
It's... right there?
I think this kind of radio experimentation falls squarely within the domain of amateur radio and it would be nice to be able to use bands where we have primary status and higher power limits. And in order to use amateur radio bands you need to not encrypt your transmissions.
I did update the blog post a bit, adding this clarification:
And in order to use amateur radio bands you need to not encrypt your transmissions.
I wrote this to put my (mild) frustration with the state of cryptography in emerging mesh networks into words. I see the reliance on the congested public bands as a downside and I think that for these kinds of networks encryption isn't actually particularly valuable.
Cryptography turns arbitrary problems into key distribution problems.
How would you expect key distribution to work? Would/should keys be tied to callsigns? If so, is there a central authority (National Amateur Radio Societies?) who are signing certificates saying that this person actually is responsible for this callsign? (perhaps based on LoTW?) Or TOFU like meshtastic's encryption keys?
(To be clear, I do think that you're right, but I think there's a lot of problems here that nobody has figured out good solutions to)
The key distribution would be the biggest pain point, for small regional nets the local amateur radio clubs could act as CAs and potentially federate with other clubs they trusted. Could also follow the Logbook of the World approach and simply send amateurs who request a code a postcard at their registered address. Though that's both slow and expensive (4USD/postcard).
Clubs being their own CA and federating is a web-of-trust like thing, and it seems that we'd end up with something like the webpki, where there's a massive CA trust store that everyone needs to keep up to date.
We'd also need a way of dealing with revocation if someone loses their private keys, or they're accidentally or maliciously compromised. The easiest way of doing this is having certs with short lived signatures.
Or perhaps the easiest is just to go with TOFU. And let people assign their own local pet names to public keys and decide which keys to trust or deny and not try and tie them to callsigns.
If you have TOFU then the signatures don't really matter anymore, because all you really know is that "this sender has sent something before".
Also, a sufficiently large clear mesh network becoming hegemonic could also hide legitimate encrypted transmission that need to be hidden, we know how to make stegano since ages now~
Every signature uses up bandwidth. For ed25519 you need to spend 64/bytes per message for the signature.
Why not encrypt a few messages with AES and then send a signed key for decrypting them all? This way you also get plausible deniability if the messages are published online.
That could work, but you'd have to wait until you received all of them before verifying the signature. At that point just number them and include the signature on the last message.