e63203ff56
App-level token bucket on rend accepts (30/60s, burst 10), panic-safe TUI restore, sqlite WAL + integrity_check fail-closed. Encrypted owbak1 identity backup/restore. README and threat model cover profile, XMR sidecar, backup, mixed-version frames.
2.9 KiB
OnionWire threat model (v1)
OnionWire is a two-party chat over Tor onion services. There is no chat server.
Tor relays are not a chat server
Each install hosts its own v3 onion and dials friends’ onions through in-process Arti. Relays move cells; they never see plaintext, never store messages, and never hold a roster. Compromising a relay is not compromising OnionWire’s message store. The store is the sqlite file on the endpoint.
Location updates are not a missing-person finder
A signed loc frame (onion, ts, sig) rewrites a friend’s locator only if that friend is already in the roster, the signature verifies against the pinned pubkey, and ts is newer. There is no directory, DHT, or introduction server. If you rotated while they were offline, they cannot find you until they rescan your QR. OnionWire will not hunt for a missing person.
Rotating the onion does not revoke a friend
F4 changes the locator only. The identity key is unchanged. Anyone who already has your pubkey can still prove they are talking to you, and a later QR/rescan with the same k updates their row. To become a new person, /wipe-all (new identity key). There is no in-band unfriend/revoke in v1.
v1 stores plaintext locally
The message log, identity secret key, and friend public keys sit on disk unencrypted (aside from whatever the OS/FDE provides). A seized laptop yields the chat history and who you talk to. /wipe overwrites message bodies and vacuums; /wipe-all deletes the data dir. sqlcipher is out of v1.
Fail closed
Peer onion down → send fails. Fingerprint mismatch vs the pinned key → hard fail, no send. Arti HS experimental: if it cannot publish, OnionWire stops; it does not fall back to C-tor.
Profile is friend-visible, not a directory
A signed prf frame is shown to people who already have a session with you. Apply only for existing friends. There is still no name lookup, DHT, or public profile server. Anyone who already has a Noise session can see the profile you send them; that is not confidentiality against that friend.
Monero sidecar is not a wallet
OnionWire never holds spend keys. Optional ONIONWIRE_WALLET_RPC talks HTTP to a user-hosted monero-wallet-rpc. Never trust a rcp frame without RPC confirmation (verified stays 0). Subaddress reuse is the user’s wallet policy.
Backup file is the identity
/backup writes the identity and Noise static secrets. Treat the file like onionwire.db. Restore overwrites self keys and does not rewrite the friends table.
Rate limit is availability, not anonymity
Incoming rendezvous accepts are token-bucket limited (30/60s, burst 10). Excess is dropped without handshake. That is a DoS/availability control. It does not hide that you run an onion, and it is not a traffic-analysis defense.
Out of v1
Prosody, XMPP, s2s, MAM, carbons, outbox, multi-device, DHT / name server, sqlcipher.