meowlib/doc/protocol.tex

\documentclass{article}
\usepackage{fetamont}
\begin{document}
\title{
    \textffm{Meow} messaging protocol}
\author{Author
   \texttt{meow@redroom.link}}
\date{\today}

\maketitle

\begin{abstract}

    
    The \textffm{Meow} protocol is a privacy driven instant messaging protocol. 
That protocol might be used for creating secure and distributed chat services or allowing machine to machine communication.
This document describes the services provided by the protocol, the messaging structures and the transport protocols that might be used.
\begin{quote} 

    \centering 
    \emph{"Nous ne vivrons pas d'utopie collective, nous arrivons trop tard, le grand marché est déjà là.
Nous devons élaborer des stratégies de survie et de contamination, par la prolifération d'utopies privées, cryptées, qui se substitueront à l'ancien ordre social. 
Tout ce que je sais, c'est que nous vivons dans un monde dont on ne s'évade pas"}\\
\footnotesize{Maurice G. Dantec for NOII (1997)}
\end{quote} 
\end{abstract}


\section{Services}
\subsection{Unregulated identities}
The only requirement to get a valid \textffm{Meow} identity is to generate a user key pair.
No phone number or email check will be performed, unlike main instant messaging protocols, there is no central administration.

\subsection{Fine grained privacy control}

\subsubsection{Trustable server based communication}
Like most widely available messaging softwares, (Whatsapp, Signal, Viber, Telegram...), \textffm{Meow} provides a simple server based messaging.
The main difference is that \textffm{Meow} allows you to explicitly choose which server you want to use.
The server code being open source, we strongly encourage you to run your own server at home or in your company.
The server requires very few ressources and will run on any low cost single board computer.

\subsubsection{Anonymized message transfer}
\textffm{Meow} also provides an anonymizing transfer service very similar to the Tor Onion protocol, we call it the Matriochka protocol.
Any server can be used for building the transfer chain. 
Some of them might be marked as trusted.
Random delays might be set for each forwarding step, making the overall message tracking much more difficult, even with a global network audit.
It is strongly advised to use trusted servers as your first node and message server (the one that holds your incoming messages).

\subsubsection{Presence protocol for direct messaging}
A presence service associating your conversation keys to your IP address for direct peer to peer connection is also provided.
The presence protocol is simply activated by setting a flag in the message poll requests. 
If that flag is set, your encrypted IP will be published on the server, allowing your only your peer(s) to decrypt it and directly communicate with your terminal.

\subsubsection{Peer based privacy settings}
You might define specific communication privacy preferences for each of your contacts: 
\begin{itemize}
    \item simple server based communication allowed for Joe, 
    \item preferred direct communication with Julian, fallback to my own server, 
    \item required matriochka protocol for Edward, first node is one of my trusted servers, my message node is my own server, randomly switch from trusted server lists for others.
    \item ...
\end{itemize}

\subsubsection{Resistance to device requisition}
All your contact information and discussion are encrypted on the device and password protected. 
Password shall be asked on application startup and allows your identity file and contact decrytion.
That password is not recoverable, so you can't forget it, or you'll loose your whole configuration and identity.
Real security implies some constraints.
You might configure the app to save your password, but that is a security flaw.
In many authoritarian countries, you are required by law to provide your device passwords to authorities.
In a \textffm{Meow} device, you might set a special password for specific contacts. 
Those contacts won't be visible when entering your main identity password.
You'll have to type their specific password in order to make them visible.
The \textffm{Meow} application will by default create a random set of fake hidden contacts and conversations.
Even in case of device storage analysis, authorities won't be able to differentiate a real hidden contact from an normal fake generated one.
It could be argued that this feature puts every user at risk, because authorities might think you're hiding something, even if you're not. 
As every \textffm{Meow} user has the same constraint, users are not responsible for that. Moreover solidarity is also a requirement for real security.
 
\subsection{Multiple devices support}
\textffm{Meow} allows you to be connected from multiple devices and offers chat synchronization capability.
A device might be revoqued anytime from any other one. Proof of your identity (password or other) shall be provided in order to grant device revocation.

\subsection{Adding contacts}
If you want to add a new contact, keys and uuids will be generated, then a rendez-vous card will be created.
That rendez-vous card might be sent by any trustable communication means, or preferably from hand to hand, as a file on a flash disk or a QR code.\\
In return your contact will provide the exact same data, encrypted with your public key and delivered to the address specified in the initial rendez-vous card.

\subsection{Contacts forwarding}
By using the \textffm{Meow} protocol a user won't be able to forward your contact information without your consent.
Each user knows you as a different identity, thus forwarding a known identity to another user is meaningless. Any message to that identity signed by another user than you would be discarded.


\subsection{Group conversation}
A very basic group messaging service is available. It allows to exchange group information between users. After that, a message to a group will send a copy of the message to each member.


\subsection{Emergency broadcast}
A local (server based) emergency broadcast service will be provided. It will provide the ability to send/receive broadcast messages to all users connected to the current server.


\subsection{Public networks shortage resilience}
\textffm{Meow} may run without Internet connection, either on an isolated wifi access point, or on a meshed network of wifi routers or even via serial IOT transport layers (LoRa,...)


\subsection{User directory service}
This service allows to restore a lost functionality of Internet historic chat services (like ICQ). You could simply set a "Free for chat" status that would allow other people to contact you, either randomly or based on a short description that you might provide.
Why providing that service while the internet is suffocating due to the abundance of social networks ?\\
Well, that option offers a few advantages :
\begin{itemize}
    \item you are still an anonymous user chatting with other anonymous users;
    \item no social network algorithm will select people that think/behave/vote/eat... just like you. Diversity makes a better world;
    \item a smaller community of users, skilled enough to operate a \textffm{Meow} chat app... that might provide a first filter;
    It's a bit like in the old times, when people had to be able to start a win98 computer, connect it to internet, then download and install ICQ...
    If you lost some time in social networks, and experienced ICQ in the 2000's, you'll understand.
\end{itemize}

\section{Identities and keys}

\subsection{User identity}
Each \textffm{Meow} user has a unique identity. That identity is strictly private, only used to manage your own data (local encryption, devices, ...)
Let's call that one the User Key Pair (Ukp)

\subsection{Contact identity}
Each of your contacts will know you under a different identity, we'll call that one the Contact Key Pair (Ckp)
That contact Key Pair will not change once it's agreed between both peers: an initial key will be exchanged as part of the peer invitation process.
As other people might have seen your key, this means that :
\begin{itemize}
    \item none of your contacts will be able to forward your id to another person without your consent;
    \item any message to that Ckp, not signed by its associated user, will be discarded.
\end{itemize}

\subsection{Conversation encryption}
Each conversation with one of your contacts will be encrypted using an encryption keypair (Ekp) allowing cyphering your conversation.
The Ekp might be changed anytime by its owner and the new public key will be sent along the last message.

\subsection{Conversation lookup}
A contact conversation Lookup Key Pair(Lkp) is also associated with your conversation. The Lkp public key is used to identify your conversation on a server.
The private key allows you to sign your request and prove the server that you are the legitimate recipient for a message.
This Lkp can be changed anytime by its owner and the new public key will be sent along the last message. 
The Lkp and the Ekp are only changed once the change has beeen acknowledged by your contact.

\subsection{Server identity}
Each server has a Server key (Skp). That key allows you to cypher the messages that you're sending to the server.

\subsection{Device identity}
Each device is identified by a device key (Dkp) that allows you to perform secured exchanges between your devices for synchronization/revocation purposes.
Communication between devices is achieved using the same principle as the user to user communication. A device might be considered as any another user. The messages content is based on a synchronization protocol.

\section{Contact management}
\subsection{Adding a contact}
Rendez-vous card, containing : 
\begin{itemize}
    \item Your public key for that contact;
    \item An initial conversation public key for getting encrypted messages from that contact;
    \item An initial conversation uuid that you'll use to lookup for incoming messages on the servers;
    \item A list of your preferred message servers;
    \item A signature to prevent transmission of tampered data.
\end{itemize}
\subsection{Sharing a contact}
If a user wants to forward one of his contacts to you, it will be handled as a double request:
\begin{enumerate}
    \item I'm receiving a contact name, without any key
    \item 
\end{enumerate}

\section{Messaging}
\subsection{User messages}
TODO

\subsection{Server stored message}
TODO

\subsection{Matriochka message packing}
TODO

\subsection{Synchronization messages}
TODO

\section{Transport protocols}
\subsection{URLs}
Server urls do define the protocol used for communicating with the server.
Some of the protocols will be described hereafter, but that list is not exhaustive and might be extended in the future.\\
Examples of a valid url:
\begin{verbatim}
http://myserver.com
https://user:pass@myauthenticatedserver.net:8443
mqtt://mymqttserver:6203
udp://myudpserver.org:41325
serial://dev/ttyS0
\end{verbatim}

\subsection{HTTP/S}
TODO

\subsection{UDP}
TODO

\subsection{Internetless alternative routing}
TODO

\section{Server Features}
\subsection{Server catalog}
Each server will cache a list of all the servers that it is aware of.

\subsection{Antispam}

\subsection{Self defense}




\section{Backup}
\section{Recovery}

\section{Very secure devices}
You don't trust your phone ?

\section{Roadmap}
\subsection{Nations}
Beyond the scope of user directories, we plan to implement the concept of virtual Nations.
Today still, most people don't really choose the nation they live in. 


\end{document}