[Cryptography] New White Paper: GhostLine - Information-Theoretically Secure Multi-Party Chat

[Ferecides de Siros]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Salut Pierre,

Excellent questions! Merci for taking the time to examine the implementation so thoroughly. 

Here are the precise technical details:

True Randomness: 
OTPs are generated from multiple cryptographically secure entropy sources:
/dev/urandom on Unix-like systems (including Linux and BSD)
Hardware TRNGs (True Random Number Generators) when available
Entropy pooling from multiple hardware sources (RDRAND, noise-based RNGs)
The initial OTP generation occurs during setup phase using CSPRNGs meeting NIST SP 800-90A standards


OTP Distribution: 
As specified in section 3.1, OTP material is distributed via secure out-of-band channels 
(physical exchange, trusted couriers, quantum-resistant protocols, etc.) before any communication begins.


Message Collisions & Synchronization: This is precisely why I implemented two key features:

Presence Server (port 8081): All participants must be online and synchronized before communication begins. 
This prevents late-joining participants from causing state desynchronization.


Gentleman Protocol: Users cannot speak simultaneously. The system requires turn-taking enforced at the protocol 
level, not just the UI layer. This ensures atomic OTP consumption and perfect state synchronization across 
all participants.

The combination of presence verification and turn-taking prevents OTP reuse and maintains the ε-ASU₂ security 
guarantees outlined in Theorem 6.3.

The Rust implementation uses atomic operations for local state management, but the protocol design prevents 
race conditions at the network level through explicit synchronization requirements.

Would you like me to elaborate on any specific aspect?

Meilleurs messages,
Hitokiri
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOPhOn65N+XbUXMpWZ3IkUdCGxpUFAmi+CTkACgkQZ3IkUdCG
xpVV1w//TAVlNU3koRcAsTCW23sR1qdoEvBKsbvf1KkMyqQzOwXDDnMYe9O9niYJ
zZi/Z0QVOWlicORPrIzv0ss+CU0VFsEwP+4BH8PPt/uRxrQ6bvy+5G0c7bWAY3c6
+dBX/6QKunYI9M9ElE+Zq30ZKazlMdQJKNGb5aXAdcwgPUo/vdbs/p8gFWtfan2t
UsVzqryFQ1vYkK0gZScr/VYHX2y2re5/TBnjsKwaIXoHaFc+lf11oF5Q+Ku3QCFA
gjxlveww/flVfEkYoGBAdB2IfanCAvbePMP538aKrnm1RgY6QmhKoa4qyVZdPe9f
L8Gddbc6CriO4Zss1+nMcbrM4B/zA/FZ1tZqp/6aAkyKHerET6m8xC6+CctlodE5
LQWMK7QjYm5ne3kTe9XaGHduxxEUVJBXmHXHh34lhVErWzpMrnXEpdh7X5A5HQgg
WTYAdz5LFlN0yxNQwPagVbnuRbEAtLCaaR/4eOfFAK/SAIm3qkGI0ksBwXj+eVPw
EUrs65pVL0NYcerk9E1NkenMJlUAJKYWvgzAwZr6JPvvoVLpxoVYH4Q2ngUjkdBo
7X0UE+ZdIuNWjO8Tlq4FQP0DbzaMzff9YCKP7T31H4B7unQEFwG6smhtUwLHkym/
m5VMe9yFQs2b6qMB7m+vYXVgiFOXyUzhixPo3cbQTwKSCuNynPY=
=DN7w
-----END PGP SIGNATURE-----



Sent with Proton Mail secure email.

On Sunday, September 7th, 2025 at 16:09, Pierre Abbat <phma at bezitopo.org> wrote:

> On Saturday, September 6, 2025 10:49:49 AM EDT Ron Garret wrote:
> 
> > I'm posting this as a public service to the crypto list. I looked at this
> > paper so you don't have to. The paper appears superficially plausible, but
> > the general heuristic that any mention of a one-time-pad is a strong
> > indicator of crackpottery applies here. AFAICT on a cursory reading, the
> > paper isn't wrong, it just leaves out one teensy little detail: key
> > exchange. There is a reason that OTP is never used in practice despite
> > being information-theoretically secure.
> > 
> > There are additional clues: the "From" header lists the senders name as
> > "Ferecides de Siros" [1] but the message body and the paper both say that
> > the author's name is "Hitokiri Battosai" [2], and the "about me" page on
> > the web site listed in the contact information in the paper says "I'm
> > Aristoh4ck8r, the enigmatic force behind the curtain."
> 
> 
> All of these were my concerns as well when I gave it a quick glance, except
> that I didn't get as far as "Aristoh4ck8r". (I'm moving and was too tired to
> think of crypto; also, Ferecides posted it at a time that here is the night of
> the Sabbath, and I had to get enough sleep to not nod off too much in church.)
> I just cloned the repo and looked at the code, of which there is a lot less
> than I expected, and have some more questions: How do you get truly random
> numbers for the OTP? How do you distribute the OTP? What happens if Alice
> sends Bob a message at the same time that Carol sends Dave a message? Can they
> use the same piece of OTP, thus producing depth?
> 
> Pierre
> --
> Don't buy a French car in Holland. It may be a citroen.
> 
> 
> 
> _______________________________________________
> The cryptography mailing list
> cryptography at metzdowd.com
> https://www.metzdowd.com/mailman/listinfo/cryptography