Multiparty Encryption in Public IRC Channels with IRCSRP

September 06, 2011

Most instant messaging encryption plugins only support peer to peer level encryption. IRCSRP allows an entire IRC channel to communicate securely. In fact this technique is not bound to the IRC protocol. IRC was chosen for it’s wide availability and numerous scriptable clients.

This post is a quick start guide. Source available on github repo.

What is IRCSRP?

IRCSRP is based on the SRP-6 protocol for password-authenticated key agreement. While SRP was originally designed for establishing a secure, authenticated channel between a user and a host, it can be adapted for group communications

Design and reference implementation by Björn Edström

WARNING

IRCSRP and my implementation is theoretically secure. Don’t assume IRCSRP is unbreakable. I am not a security expert.

The client plugins functionally work, but require some polish. Patches welcome via github. See “What’s Missing / Unpolished” at the bottom for remaining work.

Current Operating System and Client Support

A friend and I have implemented IRCSRP plugins for both Pidgin and Weechat. With support for the following operating systems:

Linux with Pidgin and Weechat
Windows with Pidgin and helper libraries (OpenSSL, GMP)

You can use the existing Python and Perl libraries to implement in your preferred client.

What Does It Look Like?

This is Colloquy running not authenticated and Pidgin (over X11 from my Linux system) connected to 2 different IRC servers both authenticated with Dave.

top secret

Dave Setup in Weechat

You need someone to act as Dave (the authority which you exchange keys with). Currently only the Weechat plugin supports acting as Dave. It’s advisable to set up a non-human instance running Weechat under screen or tmux.

Download the Weechat plugin and save to ~/.weechat/python

Start weechat from a terminal

weechat-curses

load the Python plugin:

/python load ircsrp.py

You now need a roster file. This file will contain the shared username and password your Alices will authenticate against. The data is currently stored in a Python pickle file. Note: in the future this system will be replaced by a HTTPS user creation then an /INVITE to an encrypted channel.

$ mkdir ~/.weechat/ircsrp_rosters

Use this Python script to create the roster file

import pickle
import pprint
import sys

from ircsrp import *

cmd = sys.argv[1]
filename = sys.argv[2]

if cmd == "read":
    roster = pickle.load(open(filename, 'r'))
    pprint.pprint(roster.db)
elif cmd == "write":
    user = sys.argv[3]
    password = sys.argv[4]
    s, v = ircsrp_generate(user, password)
    roster = open(filename, "w")
    i = IRCSRPUsers();
    i.db = { user : (s, v) }
    roster.write(pickle.dumps(i))
    print "Wrote roster for user", user, "to", filename

Invoke as:

(loading ircsrp.py lets us create a class with the user/password details inside)

$ PYTHONPATH=~/.weechat/python/ircsrp.py ./rostermaker.py write \
~/.weechat/ircsrp_rosters/<roster-name>.roster <user> <password>

And verify with:

$ PYTHONPATH=~/.weechat/python/ircsrp.py ./rostermaker.py read \
~/.weechat/ircsrp_rosters/<roster-name>.roster

And you should see something like (user will be whatever you used as <user>):

{'user': ('IC\x1d\x82C\xc0S\xdfPa\xa9\x90\xd9ZA\xba\x950x\x97\x91\xd9\xdaX\xc7\x03\xee\xd4-j6I',
          10189809602186580771106727590145515517419174272981738796118546071869727...giantint...)}

Now connect to any IRC server and some channel and run

(don’t append .roster to the <roster-name>

/ircsrp dave-enable <roster-name> #secretchannel

Alice Setup

Now our central authority is in place, we need to setup our client.

Pidgin non-Windows Alice Setup

Install the GMP library. Your system most likely has it installed and if not, install from your package manager. GMP will be doing all the heavy lifting on the math side for us.

Install cpanm

Run

$ sudo cpanm Algorithm::IRCSRP2

… and wait awhile for all the dependencies to install … (sigh, sorry, Perl has some major default caveats only additional libraries can solve)

Now, copy ircsrp.pl to your local or system Pidgin plugin directory. ~/.purple/plugins/ for local.

Load up Pidgin and go to the “Plugins” option in the “Tools” menu. You should see an option for “ircsrp”. Check the box to load the plugin.

Join an IRC channel.

We now want to authentic with the shared username and password that you setup with Dave earlier.

/ircsrp enable <dave-nick> <user> <password>

And a new conversation window should appear simulating a conversation. If all is well, you should see

(11:23:31 AM) (from ircsrp) You are now authenticated with dave

Weechat Setup

/ircsrp enable <user> <password> <dave_nick> <channel>

Once you are authenticated your user name should show a ¤ prepended to the nick. You can also identify other authenticated users this way.

What’s Missing / Unpolished

Need to create a manual shared secret (user/pass combo) Python Pickle file (the invite support will eliminate this)
Support an HTTPS interface to create new roster files
Easier Pidgin deployment through a reduced set of dependencies
No Dave support for the Pidgin plugin (half implemented)
No topic decrypting support for Pidgin
MacOSX support with Weechat
Multiple IRC servers/channel support in Pidgin may not work as expected
And the rest

adam flott