Bit Chat Version 3.0 Released With Upgraded Cryptography!

Technitium Bit Chat version 3.0 (alpha) is now available to download from the main website and via automatic update mechanism for existing installations. The software checks for new update automatically with every start but, you can also use the Check For Updates option in the main menu to get an update instantly.

The latest version has protocol level updates which makes it incompatible with the previous versions and thus all peers must use the updated version to be able to chat. You wont notice any changes in the user interface (UI) since the changes are only related to the protocol.

The primary aim of this update is to improve the cryptography implementation used in Bit Chat. The newly added code provides strong cryptography with following features:

• The new protocol (v3) implements Perfect Forward Secrecy (PFS) using Elliptic Curve Diffie-Hellman (ECDHE_RSA 256bits) and Diffie Hellman (DHE_RSA 2048bits) for ephemeral key exchange mechanism with RSA for authentication using certificate (Bit Chat profile certificate). Mono framework doesn't implement ECDHE algorithm and hence Linux version of Bit Chat can use only DHE algorithm while Windows version of Bit Chat is able to use both the algorithms. AES 256bits in CBC mode is used to encrypt the data as it was in previous protocol.
• Key re-negotiation feature is added to protocol to negotiate new ephemeral key for data encryption based on time and data transferred. This allows the encrypted data channel to remain always ON while ensuring the protocol security by using different ephemeral keys.
• Authenticated encryption (Encrypt-then-MAC) is implemented using HMAC-SHA256 to check if the encrypted data was authentic (that is, to check if the encrypted data was modified in any manner while in transit).
• In addition to profile certificate based authentication, pre-shared key is used to establish the encrypted channel. The pre-shared key used here is the Group Chat password that was set while creating the chat. So, using a password for your Group Chat will improve the protocol security.
• The security of encrypted profile file (which is stored on your computer and contains your RSA private key for the profile certificate) is also improved by implementing PBKFD2 using HMAC-SHA256 with 200,000 iterations. This implementation will improve security of the file against password cracking or brute force attacks.

The above features updates are in addition to the existing ones listed below:

• Peer-to-peer architecture similar to how Bittorrent works. Infact, Bit Chat uses Bittorrent trackers to find peers in your group chat. So, you connect directly to peers without any server in the middle! Another advantage is that the data is routed through shortest path, that is, if your friend uses Internet from the same service provider as that of you, then the communication is not going to leave the local network of the service provider. And if your friend is on private LAN network, the communication stays in the private network itself, so you don't even need Internet for private LAN chat!
• A complete end-to-end encryption with digital certificate (profile certificate) based authentication combined with peer-to-peer network means nobody can snoop on your messages and you can ensure the identity of your friends.
• Transfer huge files with ease! All peers in the group that participate in file transfer share the bandwidth. It works similar to how files are shared using Bittorrent but, in a close group of users. Also, files transfered are encrypted just like your messages.

The source code is updated on GitHub and you can inspect the TechnitiumLibrary.Security .Cryptography project for verifying the implementation. And as always, send your feedback to support@bitchat.im.

Bit Chat: A Peer-to-Peer Instant Messaging Concept Using BitTorrent Trackers

UPDATE: 5 Jan, 2015
Technitium Bit Chat (alpha version) is now available for download at https://bitchat.im

Bit Chat is a concept that I got while thinking about having a instant messaging (IM) system which would be completely decentralized, peer-to-peer and friend-to-friend and would provide confidentiality and optionally authentication. In this regards, BitChat can be considered a darknet system. BitChat takes many of the BitTorrent concepts and uses them to provide an instant messaging (IM) system instead of file sharing.

The classic problem faced in peer-to-peer system is to find IP address of peers who want to communicate together privately in a group. BitChat concept finds solution for it by using existing BitTorrent trackers and forming a peer-to-peer network by connecting to the nodes which are being tracked by the same infohash. DHT can also be used with trackers.

The current concept allows to use channels (similar to IRC channels) over which peers can communicate. Each channel has its own unique infohash. The topology currently thought is a full mesh network between small number of peers.

Each peer starts with a .chat file (just like a .torrent file) which contains infohash and tracker list. The file can be exchanged by email or any other way (even offline). BitChat client would use this file and get an IP address list of all the peers from the trackers mentioned in the file.

For providing privacy, BitChat would fake user agent info of popular BitTorrent clients so that even tracker servers dont know the intentions of the users. The client then maintains a peer list and connects to each of them in a full mesh.

Every connection to another peer is done with a brief handshake in which each peer exchange their identifiers, public keys and a list of peers that each one of them have (similar to peer exchange). Any new peer found from another peer is immediately connected in order to have a full mesh network. Each connection to a peer can be using TCP if directly feasible or UDP in case of client being behind NAT. UDP would punch holes in NAT allowing direct communication between peers possible. The client will have to implement a TCP like retransmission mechanism to solve problems with dropped UDP packets.

A client behind a http proxy can be supported such that it creates outbound connections to rest of the peers. Two peers behind http proxy will not have a direct link in such case and messages between them will have to be routed through other willing peers.

Authentication can be done with the help of public key cryptographic algorithms like RSA. The public key of peers can be exchanged online/offline and a small address book be maintained by BitChat clients to identify friends. The public key exchanged during peer-to-peer handshake will be matched with the address book to verify identity of known contacts.

A channel can be open ended or invite only. If the channel is only for closed group, the BitChat client can reject peer request from unknown contacts. In any case, only users who have the .chat file (or the infohash) can join the network in first place.

Confidentiality can be achieved by using public key cryptography. The public key of each peer will be used to do a key exchange for an agreed upon symmetric key algorithm. Each connection to a peer will have a separate key and it can be renewed with a handshake at regular intervals.

The system would allow for a common chat for all peers in a channel as well as private one-to-one chat. A group chat with only selected peers can be made with the group chat initiator deciding on whom to invite from the peers.

A simple client would implement text chat with a simple one-to-one file sharing. While, clients which can support voice and video chat can be developed.

Security issues which affect BitTorrent also apply to BitChat. The IP address of all peers is open to anyone knowing the infohash being used. Mitigation can be done by use of VPN or proxy services.

There are lot of peer-to-peer projects already being developed and used. BitChat concept is about using an existing infrastructure provided by BitTorrent and using it for a secure, private and user friendly instant messaging system.

The protocol specification is under development and will be made public so that anyone can make their own BitChat client. Any inputs and queries are most welcomed. Post comments or send an email to me (shreyas at technitium dot com).