Task #2578
make Kerplapp certs as generic as possible
| Status: | Closed | Start date: | 11/20/2013 | |
|---|---|---|---|---|
| Priority: | Normal | Due date: | ||
| Assignee: | pd0x | % Done: | 0% | |
| Category: | - | |||
| Target version: | 0.1 - "Kerplapp" | |||
| Component: |
Description
I was just thinking, the kerplapp cert should probably look as generic as possible, like a wifi router's cert or something. I.e. remove identifying info from it. the Tor certs originally were marked as tor certs, but then Tor was filtered and monitored based on that. so I could see some kind of city wifi system monitoring traffic, and being set up to look for Kerplapp certs.
History
#1 Updated by hans about 4 years ago
- Target version changed from 0.1 - "Kerplapp" to 0.2 - ChatSecure/Bluetooth
#2 Updated by pd0x about 4 years ago
- Status changed from New to Resolved
There are presently two self signed certificates being generated in KerplappKeyStore.java:
1) A self signed certificate used to identify the public/private key pair that are used to sign the index.jar
2) A self signed certificate used for HTTPS
The index.jar cert has some Kerplapp specific information bundled into it:
X500Name subject = new X500Name("O=Kerplapp,OU=GuardianProject");
The https cert has nothing other than the CN field with the host IP:
X500Name subject = new X500Name("CN="+hostname);
It might be worth discussing whether there is more appropriate identity information to embed in the index cert, or whether there should be nothing at all. The cert of the index.jar will never be seen by a passive network adversary due to the HTTPS protection (at least with that transport mechanism), and the https is vanilla.
#3 Updated by hans about 4 years ago
- Status changed from Resolved to Closed
- Target version changed from 0.2 - ChatSecure/Bluetooth to 0.1 - "Kerplapp"
I guess that the index.jar contains so many other distinct markings that removing that one doesn't make any sense. Closing this issue