10-12-2012, 04:50 PM
SILC (SECURE INTERNET LIVE CHAT)
silc.doc (Size: 415.5 KB / Downloads: 26)
ABSTRACT
The purpose of this paper is to give short but deep enough introduction to the SILC Protocol. The document describes the purpose of the protocol and how the protocol works in practice.
The Secure Internet Live Conferencing (SILC) protocol is a new generation chat protocol which provides full featured conferencing services, just like any other contemporary chat protocol provides. In addition, it provides security by encrypting and authenticating the messages in the network. The security has been the primary goal of the SILC protocol and the protocol has been designed from the day one security in mind. All packets and messages travelling in the SILC Network are always encrypted and authenticated. The network topology is also different from for example IRC network. The SILC network topology attempts to be more powerful and scalable than the IRC network. The basic purpose of the SILC protocol is to provide secure conferencing services. The SILC Protocol have been developed as Open Source project. The protocol specifications are freely available and they have been submitted to the IETF. The very first implementations of the protocol are also already available.
INTRODUCTION
Chat protocols are very popular on the Internet. They have actually been very popular since the very first chat protocols appeared on the net. The Internet Relay Chat (IRC) was one of the first chat protocols, and quickly gained the status of being the most popular chat on the net. Today, IRC has several competitors from various other so called Instant Messaging (IM) protocols, such as ICQ. However, all of these different chat protocols have something in common; they are all insecure. The security is important feature in applications and protocols in contemporary network environment. The older chat protocols, however have failed to meet the growing security requirements on the Internet. It is not anymore enough to just provide services, like for example chat services. Now, they need to be secure services.
ABOUT SILC
SILC (Secure Internet Live Conferencing) is a protocol which provides secure conferencing services on the Internet over insecure channel. SILC superficially resembles IRC, although they are very different internally. They both provide conferencing services and have almost the same set of commands. Other than that, they are nothing alike. The SILC is secure and the network model is entirely different compared to IRC.SILC provides security services that any other conferencing protocol does not offer today. The most popular conferencing service, IRC, is entirely insecure. If you need secure place to talk to some person or to group of people over the Internet, IRC or any other conferencing service, for that matter, cannot be used. Anyone can see the messages and their contents in the IRC network. And the most worse case, some is able to change the contents of the messages. Also, all the authentication data, such as, passwords are sent plaintext in IRC. SILC is much more than just about `encrypting the traffic'. That is easy enough to do with IRC and SSL hybrids, but even then the entire network cannot be secured, only part of it. SILC provides security services, such as sending private messages entirely secure; no one can see the message except you and the real receiver of the message. SILC also provides same functionality for channels; no one except those clients joined to the channel may see the messages destined to the channel. Communication between client and server is also secured with session keys and all commands, authentication data (such as passwords etc.) and other traffic is entirely secured. The entire network, and all parts of it, is secured. We are not aware of any other conferencing protocol providing same features at the present time.
HISTORY
SILC, designed by Pekka Riikonen, was released to the public in the summer of 2000, but both the idea and the original protocol date from 1996. The first lines of code were written in early 1997, and SILC has been rewritten three times since that very first version. The original implementation of SILC included a client, a very preliminary server, and implementations of both the RSA and 3DES encryption algorithms. The server was unusable, but the client looked every similar to the one found in the first public release. That release's random number generator was inspired by the RNG that SSH used; the current one is based on that original implementation but has been rewritten twice since then. SILC's development was temporarily suspended for a few months in 1997, when Pekka's time was consumed with work and school. It resumed in 1998 when Juha Räsänen and Pekka added an implementation of the ElGamal encryption algorithm. Development stopped again because of time constraints, but in 1998 SILC was rewritten in C++, which seemed like a good idea. Pekka had to stop development yet again in the winter of 1999 as work on his thesis took up his available time.
SILC PROTOCOL
The Secure Internet Live Conferencing (SILC) protocol provides secure conferencing services over insecure network channel. The SILC is IRC like protocol, however it does not support IRC. Strong cryptographic methods are used to protect SILC packets inside the SILC network. SILC provides all the common conferencing services like channels, channel messages, private messages, nicknames, various commands, and secure file transfer. Difference to other chat protocol is in the design of the protocol. The SILC protocol has been designed from the day one security in mind and it shows in the protocol design.
The packets and messages in the SILC network are always encrypted and authenticated. It is not possible to send unencrypted messages in SILC at all. This assures that end user cannot even accidently send unencrypted messages while thinking that it is encrypted. This is one of the problems of most of the other chat protocols that provide so called plugin encryption. They are not secure by default but try to provide security by applying external security protocol such as PGP or SSL over the insecure chat protocol. In these cases the security is achieved usually by encrypting the data while key management, message authentication and other security issues may be left out, leaving the implementation vulnerable to various security problems. The other problem is also that the external protocols tend to leave the network only partly secured; usually only two points in the network are secured with for example SSL. While SSL does provide provable security it is not enough to provide security for a chat network as a whole.
Clients
A client is a piece of software connecting to SILC server. The software is usually run by the end user, a real person that is. The purpose of the clients is to provide the end user an interface to the SILC services. They are used to actually engage the conversations on the SILC Network, and they can be used to execute various SILC commands. The clients are distinquished from other clients by unique Client ID. There cannot be multiple same Client IDs in the SILC Network at the same time. The end user, however does not use Client IDs. The end users usually selects a preferred nickname they want to use, and identifies themself with that nickname to other users on the network. The nicknames are not unique in the SILC Network. There can be multiple same nicknames at the same time on the network. Most of the other chat protocols have unique nicknames. This is where SILC differs from most of the other chat protocols. The purpose of this feature is to make IRC style nickname wars obsolete, as no one owns their nickname; there can always be someone else with the same nickname.
Servers
Servers forms the basis for the SILC Network, by providing a point to which clients may connect. There are two kinds of servers in SILC; normal servers and router servers. The next section describes the function of router server.
Normal servers connect to router server. Normal servers cannot directly connect to other normal servers. Messages that are destined outside the local server are always sent to the router for further routing. The clients usually connect to the normal server, however, clients may connect to router servers as well. The SILC Network diagram above illustrates how normal servers connects to the router server.
Routers
The router servers are servers that actually handles the message routing in the network. They are, however also normal servers and they do accept client connections. Each of the router in the network is called a cell. A cell can have only one active router and it may have several servers and several clients. The cell, however may have backup routers that can take over the tasks of the primary router if it becomes unresponsive. The switch to the backup router should be transparent and only local connections to the primary router are lost. Other connections in the cell are intact, and clients and servers merely experience some lag in the network connection during the switch to the backup router.
SILC Key Exchange Protocol
SILC Key Exchange Protocol (SKE) is used to exchange shared secret between connecting entities. The result of this protocol is a key material used to secure the communication channel. This protocol is executed when, for example client connects to server. It is also executed when server connects to router. And, there is no reason why it could not be executed between two clients too, if two clients would need to create secret key. The purpose of the SKE protocol is to create session keys to be used in current SILC session. The SKE is based on the Diffie-Hellman key exchange algorithm, and is immune to for example man-in-the-middle attacks by using digital signatures.
Channels
A channel is a named group of one or more clients which will all receive messages addressed to that channel. The channel is created when first client joins to it, and the channel ceases to exist when the last client leaves it. When channel exists, any client can reference it using the name of the channel. Channel is a place where group of people can engage conversation. Channel names are unique in the SILC Network. There cannot be multiple same channels in the network at the same time. However, channel has also a Channel ID which is actually used to reference the channel in the SILC Network. The maximum length for the channel name is 256 characters. Channels can have operators that can administrate the channel and operate all of its modes. There are two types of operators on the channel: channel founder and channel operator.
Channel Message Delivery
All clients that have joined the channel can send messages to the channel. All channel messages are secured and authenticated by channel key. The channel key is generated by the server when the channel is created, a client joins the channel, or a client leaves the channel. The channel key is also regenerated periodically.
The reason for the regeneration of channel key everytime someone joins or leaves the channel is that it prevents new clients joining the channel, and old clients leaving the channel, to encrypt or decrypt old or new messages. They can encrypt and decrypt channel messages only when they have joined on the channel.