Static Symmetric Keys

[Javantea]

Bunny uses static symmetric keys. These keys found in keys.kz are known by an attacker, so they could easily write a program to decrypt traffic sent by bunny. Solutions include PKI, pre-shared keys, passwords, and so forth. All of these have their own difficulties. Secure crypto is difficult.

[mothran]

So this is a complex issue. I know that the static keys are an issue and I made sure to make a note that if you wish to run a network that is not testing network to delete the keys.kz file. This will force Bunny to gen a new key file. Of course this still has the forward security problem.

Now to address the issue of using PKI with bunny we have to think of what Bunny's use case is. I want it to be able to mesh quite dynamically and work with many or few nodes in a lot of different Topology's. The trouble with PKI is that it has next to zero support for N-way key exchange systems. mpOTR (https://github.com/ioerror/mpOTR and http://www.cypherpunks.ca/~iang/pubs/mpotr.pdf ) has some solutions to this problem but it turns out to be quite expensive and is untested.

I kinda hit a wall with finding a good solution to the problem. I would really to work out a better way to do it if you have any ideas.

Thanks man.