Connection without a need for a magic word using hotp

[lnee94]

HOTP wikiipita

hotp works by generating a one time password using a secret key and a counter
The listener could generate an OTP of say length 8 with key 0xdeadbeef and count of 5 they get 49004148

If the receiver has the same key and can figure out the count they would also get 49004148

Pros
1: It is standard so easy to find libraries for
2: You don't have to refresh the code

Cons:
1: You have to get the count to each party, and the counts may be desynced.
2: You may have to implement a way for the listener to send the count to connector.

Thanks for your time Luke

[thiswillbeyourgithub]

Well the count could just be the number of time 30s has elapsed since a reference date until now. This way as long as they are triggered in the same 30s window they would have the same count no?

Also this reminds me about edgevpn but in python.

[meejah]

@lnee94 do you mean that after an initial connection, the two sides could (as they now share a secret) set up a HOTP-based method for future connections?

[lnee94]

@lnee94 do you mean that after an initial connection, the two sides could (as they now share a secret) set up a HOTP-based method for future connections?

Yes that is what I mean. That was something you wanted to add. to magic worm hole

[lnee94]

Well the count could just be the number of time 30s has elapsed since a reference date until now. This way as long as they are triggered in the same 30s window they would have the same count no?

Also this reminds me about edgevpn but in python.

If you open multiable applications at one time this race condition would so I think hotp would be best

[thiswillbeyourgithub]

Hi, I made my own simple shell wrapper around magic-wormhole to send files without using the same code, without sending the code every time but without considerable security tradeoffs.

It's in wormrot.sh and basically creates a different key derived from the current timestamp + a time window size + a secret.

If two scripts try to connect at roughly the same time they will find each other. The roughly depends on the time window size parameter.

Let me know what you think of this. Although I know this is not the same topic as the initial issue I still think it might be of interest here.

If you open multiable applications at one time this race condition would so I think hotp would be best

I'm not sure I follow, the hole mechanism only has 2 ends so you are not supposed to open more than 2 applications at once time.

[meejah]

If you open multiable applications at one time this race condition would so I think hotp would be best

I'm not sure I follow, the hole mechanism only has 2 ends so you are not supposed to open more than 2 applications at once time.

In this context, "multiple applications" means more than one thing using the same configuration / saved data. For example, one might open a file transfer application and also fowl. Or, one might open two copies of fowl (or a file-transfer application).

So, if both of those applications find saved data in the same place, they may end up e.g. using the same mailbox-id (if that is data that is saved). With the "30s window" situation, these two applications would end up choosing the same interval/count number if they were started within 30s of each other -- and thus both try to use the same secret.

This isn't necessarily a showstopper -- but applications then either have to limit themselves to running a single copy, or take other measures to ensure they're not both trying to use the same mailbox or nameplate at the same time.

[meejah]

p.s. I haven't had time to explore this idea in detail, and input from a real cryptographer would be good, but I'm leaving the issue open because I think it has merit and might indeed work well

[meejah]

Also, I'm very happy to use things like fowl to explore more speculative ideas like this even if they might make sense to ultimately put into the core magic-wormhole protocol. Thanks for opening this :)

[thiswillbeyourgithub]

This isn't necessarily a showstopper -- but applications then either have to limit themselves to running a single copy, or take other measures to ensure they're not both trying to use the same mailbox or nameplate at the same time.

Thanks for the clarification! Can you also explain what the magic wormhole protocol does if A and B open a persistent connection using a code then 5s later C and D tried to use the same code?

Do C and D fail and see a helpful error message? If that's the case we could trivially make the clients generate the n+1 seed

[meejah]

If more than two clients use the same mailbox they get a "crowded" error.

Your scenario is a little more interesting though: nameplates (the number in the code) temporarily point at a mailbox (large random number).

So if all 4 clients use the same code it could work out that A and B connect (then the nameplate is deallocated) and then C and D are also successful (same nameplate but new mailbox). Or it could happen due to network timing that one (or even two) of the clients see "crowded".

Regardless, they will see a useful error

[thiswillbeyourgithub]

Alright, so i'm not sure why you made it sound like a problem:

This isn't necessarily a showstopper -- but applications then either have to limit themselves to running a single copy, or take other measures to ensure they're not both trying to use the same mailbox or nameplate at the same time.

Given my wormrot.sh project, it sounds trivial to add a bit of logic so that if a client encounters a "crowded" error, it justs increments the seed counter until one code is not crowded. In effect any number of client could be connected at the same time. As long as they connect sequentially.

The only issue I'm seeing is that if your goal is to have A<->B and C<->D alive at the same time, then if you start C and D before A connected to B you could end up with A<->C + B<->D (or A<->D + B<->C) but I don't want to take that edge case into account.

Wait actually: in wormrot.sh the first connection is used to send a text, containing a json which describe what is happening, for example it explains that we are doing a file transfer, or could be making a fowl connection or whatever. Hence, the receiving ends could be interchangeable. Not 100% sure but I think there's a way.

In conclusion: I feel confident that I could do a mechanism like in wormrot.sh where there is just a preshared secret in an env variable, and you could start both script at roughly (how frequently we rotate code is trivial to set) the same time and they will connect. Given that most tech have access to the same sync time. This way we could hardset predefined time for some scripts to run and they would be able to find each other without keeping the tunnel open or the process running at all times.

Also, if A tries to open a tunnel, how much time does B have to find it before the code expire in the original macic wormhole implem?

[meejah]

Part of the security argument for Magic Wormhole is the "human" aspect: a 1/65k chance is not going to work when you have to trick a human into transcribing approximately 32k codes before expecting a correct guess. However, automating this part entirely changes that argument.

With the "Seeds" plan, there's always a human-involved first setup and then you can automate future connections -- perhaps your HOTP idea fits better in that scheme (i.e. using HOTP of some kind to re-connect users, but not for the very first connection). e.g. you could use the normal, negotiated SPAKE2 secret to derive a shared key that is used via something similar to your scheme (but only when re-connecting that same connection). Does that make sense?

[thiswillbeyourgithub]

I'm sorry I didn't understand your point.

Also, I just tried a bit and notice that, contrary to the magic-wormhole cli client, there does not seem to be a way to launch fowl invite with a specific secret code. It seems to be generated inside fowl.

If I can't specify the first secret code, then I can't do the seed mechanism thingie. Is it just not implemented yet or is there a fundamental reason i'm not seeing?

[meejah]

If I can't specify the first secret code, then I can't do the seed mechanism thingie. Is it just not implemented yet or is there a fundamental reason i'm not seeing?

There's no technical reason from Magic Wormhole, this was an "ease of use" decision. I could provide an option to e.g. provide an explicit code (or if you use fowld directly, as controlling programs probably should, you can use {"type": "set-code", "code": "1-foo-bar"} as a command on both ends.