{"action":"closed","issue":{"url":"https://api.github.com/repos/Open-Transactions/opentxs/issues/392","labels_url":"https://api.github.com/repos/Open-Transactions/opentxs/issues/392/labels{/name}","comments_url":"https://api.github.com/repos/Open-Transactions/opentxs/issues/392/comments","events_url":"https://api.github.com/repos/Open-Transactions/opentxs/issues/392/events","html_url":"https://github.com/Open-Transactions/opentxs/issues/392","id":48373108,"number":392,"title":"MEP-2: Use ZeroMQ Curve for transport layer security","user":{"login":"OttoAllmendinger","id":283533,"avatar_url":"https://avatars.githubusercontent.com/u/283533?v=3","gravatar_id":"","url":"https://api.github.com/users/OttoAllmendinger","html_url":"https://github.com/OttoAllmendinger","followers_url":"https://api.github.com/users/OttoAllmendinger/followers","following_url":"https://api.github.com/users/OttoAllmendinger/following{/other_user}","gists_url":"https://api.github.com/users/OttoAllmendinger/gists{/gist_id}","starred_url":"https://api.github.com/users/OttoAllmendinger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OttoAllmendinger/subscriptions","organizations_url":"https://api.github.com/users/OttoAllmendinger/orgs","repos_url":"https://api.github.com/users/OttoAllmendinger/repos","events_url":"https://api.github.com/users/OttoAllmendinger/events{/privacy}","received_events_url":"https://api.github.com/users/OttoAllmendinger/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Open-Transactions/opentxs/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/Open-Transactions/opentxs/milestones/1","html_url":"https://github.com/Open-Transactions/opentxs/milestones/v1","labels_url":"https://api.github.com/repos/Open-Transactions/opentxs/milestones/1/labels","id":988375,"number":1,"title":"v1","description":"First commercial release","creator":{"login":"weissjeffm","id":107329,"avatar_url":"https://avatars.githubusercontent.com/u/107329?v=3","gravatar_id":"","url":"https://api.github.com/users/weissjeffm","html_url":"https://github.com/weissjeffm","followers_url":"https://api.github.com/users/weissjeffm/followers","following_url":"https://api.github.com/users/weissjeffm/following{/other_user}","gists_url":"https://api.github.com/users/weissjeffm/gists{/gist_id}","starred_url":"https://api.github.com/users/weissjeffm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weissjeffm/subscriptions","organizations_url":"https://api.github.com/users/weissjeffm/orgs","repos_url":"https://api.github.com/users/weissjeffm/repos","events_url":"https://api.github.com/users/weissjeffm/events{/privacy}","received_events_url":"https://api.github.com/users/weissjeffm/received_events","type":"User","site_admin":false},"open_issues":14,"closed_issues":2,"state":"open","created_at":"2015-02-20T14:45:41Z","updated_at":"2015-03-05T17:38:05Z","due_on":"2015-07-14T23:00:00Z","closed_at":null},"comments":6,"created_at":"2014-11-11T11:09:13Z","updated_at":"2015-03-05T17:38:05Z","closed_at":"2015-03-05T17:38:05Z","body":"**See https://github.com/monetas/protocol-docs/blob/master/content/mep/mep-002.md**\r\n\r\nCommunication between Notary and Client should be confidential and authentic.\r\n\r\nOpenTXs currently uses a custom crypto protocol for communication between client and notary on top of plain ZeroMQ. Crypto systems are hard to implement correctly and hard to maintain and audit. We should rely on existing systems written by crypto experts as much as possible. \r\n\r\nOne very promising candidate is the security system provided by ZeroMQ:\r\n\r\n> The CURVE mechanism defines a mechanism for secure authentication and confidentiality for communications between a client and a server. CURVE is intended for use on public networks. The CURVE mechanism is defined by this document: http://rfc.zeromq.org/spec:25.\r\n\r\nThis significantly reduces the amount of crypto code that OT has to implement and maintain. It also makes it easier to write alternative implementations of Client or Notary.\r\n\r\nAs an additional benefit, curve provides security features that are currently not implemented in Open-Transactions, like perfect forward security (http://curvezmq.org/page:read-the-docs): \r\n\r\n> This handshake provides a number of protections but mainly, perfect forward security (you cannot crack data encrypted using the short term keys even if you record it, and then later get access to the permanent keys) and protection of client identity (the client permanent public key is not sent in clear-text).\r\n\r\n\r\nThese blog post explain how to use the security features provided by ZeroMQ:\r\n\r\n* http://hintjens.com/blog:49 \r\n* http://hintjens.com/blog:50\r\n\r\nNecessary changes in opentxs:\r\n\r\n* Add support for key format used in ZeroMQ curve. We should use the \"Authentication\" of the notary to establish the secure connection, and use the Nym's auth key to verify messages. \r\n* Establish a secure connection using ZeroMQ (see blog post examples)\r\n\r\n\r\nThis could co-exists in parallel to the current system. \r\n\r\nNote: this is completely independent from the communication between separate Nyms via the Nymbox. "}}