[Freedombox-discuss] Follow up to the FreedomBox 'bump/hi-five' challenge

[Erik Harmon]

Why not just generate an ephemeral 256-bit AES key, encode that as a qr
code, then the freedombox owner transmits their ip address and entire PK
including sigs using that key? Via bluetooth, nfc, wifi, or whatever. The qr
code becomes of reasonable size, there's very low chance of interception,
and the you can transmit as much as you want right then and there.
On Jun 23, 2011 4:15 PM, "Kevin Steen" <debian at kevinsteen.net> wrote:
> On 23/06/11 19:46, Stefano Maffulli wrote:
>> Following up on the discussion started on FreedomBox discuss mailing
>> list with some more details on how to implement this piece of the Box
>> (@coiax on irc started calling it ManusVexo).
>>
>> The problem to solve is how two humans make the initial exchange of
>> credentials required to establish a relationship between their
>> respective freedombox installations.
>
> I may be misunderstanding how it works, but it seems the Off-The-Record
> (OTR) protocol could be useful here: Use QRCodes to exchange the Public
> Key and IP address of your FreedomBoxen, and they then have enough
> information to create a secure connection and authenticate the other
> end. (Encryption keys are created at connection time with OTR.)
>
> Then, with a secure, authenticated connection between the FreedomBoxen,
> you can share whatever other data you need to.
>
> Details on OTR: http://www.cypherpunks.ca/otr/
>
> -Kevin
>
> _______________________________________________
> Freedombox-discuss mailing list
> Freedombox-discuss at lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/freedombox-discuss/attachments/20110623/ffb80d8c/attachment.html>