Re: Gopher over TLS

On Sat, Mar 14, 2020 at 1:36 PM Emil Engler <[email protected]> wrote:
> Hi, I thought about writing a standard for a secure Gopher protocol
> (short gophers).
> Have there been any proposals for this yet and what's the general
> consensus about this on this ML




Side-note:  Apparently there is a new ("competing") protocol that is
being developed by a group of Gopher enthusiast named Gemini, which
basically adds MIME support, uses a Markdown-based syntax instead of
Gopher maps and uses TLS by default.

  https://gemini.circumlunar.space/




In that context, I made the proposal of replacing TLS with a simpler
NaCL / libsodium alternative.  And by "simpler" I mean that given one
has access to `libsodium`, or is able to copy-paste the 4
cryptographic primitives (basically XSalsa20, Poly1305, Ed25519 and
Curve25519), one should be able to implement this in a few lines of
code.

Fortunately, that proposal (given it has nothing tied or specific to
Gemini) can be re-used for Gopher (or any other message based
protocol).


Bellow is the thread and my proof-of-concept Python-based
implementation, together with a diagram, analysis and description:

* proposal document --
https://github.com/cipriancraciun/gemini-experiments/blob/master/nacl/documentation/protocol-v1.md
* proof-of-concept code --
https://github.com/cipriancraciun/gemini-experiments/tree/master/nacl/sources
* mailing list thread --
https://lists.orbitalfox.eu/archives/gemini/2020/000457.html

(Full disclaimer:  I am not a cryptographer;  I am aware of "not
implementing your own crypto";  I have not "invented" new
cryptographic primitives but instead reused existing ones the way they
were meant;  I have studied the Noise Protocol a few other proposals;
and tried my best.  See the thread for a lengthy take on this.)

(If there are any cryptographers out there, please take a look if you
want.  Thanks!)

Hope this is useful,
Ciprian.