Re: Current examples for creating keys, updating and getting freesites

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============1582803243==
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="RKfgPEKKQFEsuXawa4KREWuARqP6PfAQL"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--RKfgPEKKQFEsuXawa4KREWuARqP6PfAQL
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On 11/12/2013 04:16 AM, Michael Pearce wrote:
> I just noticed... the AntiSpamHash should also include the sender's
> identifier to avoid the sender using a nonce from a message already
> sent to the recipient and avoiding calculating the AntiSpamHash.

That does seem like an improvement, but one worry I have with
short-lived identities in general is that a spammer needs only to
compute more hashes faster to spam more effectively. It's a balancing
act between making identity establishment fast enough to be useful and
involving enough social forces / slowness to impair spam.

> On Tuesday, November 12, 2013 1:07 AM, Michael Pearce
> <michaelgpearce-/[email protected]> wrote:
>=20
> Thanks for the response!  All good information.  Its fun to think
> about how to build a system with the very specific constraints that
> Freenet imposes.
>=20
> I'm not building a messaging application per se, but users will need
> to communicate and most identities will not be very long-lived.  This
> is leading me towards thinking I can get away with a single key to
> announce new messages.  I was also thinking about adding a Nonce to
> the message combined with an expensive hashing algorithm (i.e.
> BCrypt) so spamming a user takes some work on the spammer's side.

May I ask what you're building? It will be easier to give more informed
and specific suggestions with that knowledge.

> A sender would create a message similar to:
>=20
> Sender <- my public identifier
>=20
> Recipient <- recipient's public identifer Nonce <- unique value to
> this recipient from the sender for this message
>=20
> SenderSignature <- sender signs message with (recipient, nonce) to
> ensure sender is who he says he is AntiSpamHash <- Bcrypt(recipient,
> nonce, minimum_rounds) to force some work on the sender
>=20
> MessageBodyId <- location of signed/encrypted message body located at
> a different Freenet key
>=20
> As a receiver checking for incoming messages, he only fetches the
> message body for messages that:
>=20
> * Have himself as the recipient
> * Have a unique Nonce from the sender (no duplicates to avoid
>   signature / anti-spam value stealing)
> * Correct signature at SenderSignature * Correct AntiSpamHash
>=20
> If all of these match, the receiver will then retrieve the message
> body.
>=20
> I think the above scheme will allow for looking at the shared key
> pretty quickly, and a computationally expensive AntiSpamHash will
> disincentivize large amounts of spam.  Definitely not perfect but it
> may be good enough for my needs.

This is between individual users? This sounds a lot like Freemail's use
case. Perhaps you could base your protocol on that, or use Freemail as a
transport? [0]

Steve

[0] https://github.com/Thynix/Freemail/blob/spec/docs/spec/spec.tex


--RKfgPEKKQFEsuXawa4KREWuARqP6PfAQL
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAEBAgAGBQJSiD6UAAoJECLJP19KqmFub4wP/1xHB3l5ghEcLtBxtSuaE3YW
lLvC4hFWpFc/neBaQLe1VzLakiBoBKpYTd0zx/1XCBWNKFiGZmEf5SVswuSmjl8q
xP9EA9pHcA0CczNy4m2LY/XTZUtHOLll8/0P1a4rX5Q0DtSvXjCqiQqvrvCfbus4
JboX4YLqv2hMTNlBcnPC2SgGR9r7qbbhG6zY5Kgqba/GEPWdAtt8XUydsR7A3021
4PVOr6c+VzKMtw12ZZ92ZsFfpIQ2a5Jxu7bg1ObVxxsuMI+P0/9xKASi7AQNU5vy
n72U89ounjvSyOI83bIl7wKdJcx7763phwR8G4NfjaqjUXTIUKnw1ICQiJE3xFjM
8he1FBeFO398y6WuEHJqtmKI2G+nfbwJlfVCCaAzsU40A0F8ZCrwTxbC2gq+SXrG
j10St6rFOLZ/l57YxE24GtemETNh0fzjZX15e9lDIxY0nUSddUHkc6hdFEVBwy6j
jqiS+ZkStFyTfNwi+Sctu9nT8gyjGHbxSAsdMQir4xbn5boRL2yfdZCgBygz9Qbf
mThOHoCne7tPeink7ik6fKRCym7/JsNKroNJkLGlSV6YU9T0Tl3QDcG5AXSlxbSb
ttLMAOO+/zvevke1uAmmj7Qddv2fkN+nVeXWY+f5ZkP5PALtaiYoOg/34RzbDmud
WxYK7ptJidVUpEWVYZoo
=1lWx
-----END PGP SIGNATURE-----

--RKfgPEKKQFEsuXawa4KREWuARqP6PfAQL--

--===============1582803243==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tech mailing list
[email protected]
https://emu.freenetproject.org/cgi-bin/mailman/listinfo/tech
--===============1582803243==--