Jump to content

Tox (protocol): Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
m Duplicate word removed
m additional copies of the references added
Line 60: Line 60:
The Tox core is a library establishing the protocol and API. User front-ends, or clients, are built on the top of the core. Anyone can create a client utilizing the core.
The Tox core is a library establishing the protocol and API. User front-ends, or clients, are built on the top of the core. Anyone can create a client utilizing the core.


Technical documents describing the design of the Core, written by the original Tox core library developer irungentoo, are available publicly.<ref>{{cite web|title=Toxcore Documentation|url=https://github.com/Tox-Docs/Text/tree/master/src_text|publisher=GitHub|access-date=7 November 2015}}</ref>
Technical documents describing the design of the Core, written by the original Tox core library developer irungentoo, are available publicly.<ref>{{cite web |title=Toxcore Documentation |url=https://github.com/Tox-Docs/Text/tree/master/src_text |url-status=live |archive-url=https://web.archive.org/web/20230520161806/https://github.com/Tox-Docs/Text/tree/master/src_text |archive-date=20 May 2023 |access-date=7 November 2015 |publisher=GitHub}}</ref><ref>{{Cite web |date=2023-05-20 |title=Toxcore Documentation (full copy of a repository saved via web.archive.org) |url=https://web.archive.org/web/20230520161609/https://codeload.github.com/Tox-Docs/Text/zip/refs/heads/master |access-date=2023-05-20 |website=web.archive.org}}</ref>


=== Protocol ===
=== Protocol ===


The core of Tox is an implementation of the Tox protocol, an example of the application layer of the [[OSI model]] and arguably the presentation layer. Implementations of the Tox protocol not done by the project exist.<ref>{{cite web|title=Xot|url=https://github.com/mahkoh/Xot|publisher=GitHub|access-date=6 May 2014}}</ref>{{failed verification|date=April 2018}}
The core of Tox is an implementation of the Tox protocol, an example of the application layer of the [[OSI model]] and arguably the presentation layer. While there's at least one known implementation of the Tox protocol provided by third-party developers<ref>{{cite web|title=Xot|url=https://github.com/mahkoh/Xot|publisher=GitHub|access-date=6 May 2014}}</ref>, it never lived past the prototype stage.


Tox uses the [[Opus (audio format)|Opus audio format]] for audio streaming and the [[VP8|VP8 video compression format]] for video streaming.
Tox uses the [[Opus (audio format)|Opus audio format]] for audio streaming and the [[VP8|VP8 video compression format]] for video streaming.
Line 70: Line 70:
=== Encryption ===
=== Encryption ===


Tox uses the cryptographic primitives present in the [[NaCl (software)|NaCl crypto library]], via libsodium. Specifically, Tox employs [[Curve25519]] for its key exchanges, xsalsa20 for symmetric encryption, and [[Poly1305]] for MACs.<ref>{{Cite web|url=https://tox.chat/faq.html#tox-encryption-algorithm|title=A New Kind of Instant Messaging|website=Project Tox|language=en|access-date=2017-02-15}}</ref>
Tox uses the cryptographic primitives present in the [[NaCl (software)|NaCl crypto library]], via libsodium. Specifically, Tox employs [[Curve25519]] for its key exchanges, [[Salsa20|XSalsa20]] for symmetric encryption, and [[Poly1305]] for MACs.<ref>{{Cite web|url=https://tox.chat/faq.html#tox-encryption-algorithm|title=A New Kind of Instant Messaging|website=Project Tox|language=en|access-date=2017-02-15}}</ref>


Because the tox protocol can be used by many different applications, and because the tox network broadcasts the used client, it is also possible for clients to use additional encryption when sending to clients which support the same features.
Because the tox protocol can be used by many different applications, and because the tox network broadcasts the used client, it is also possible for clients to use additional encryption when sending to clients which support the same features.

Revision as of 16:27, 20 May 2023

Tox
Stable release
0.2.18 / 18 April 2022; 2 years ago (2022-04-18)[1]
Repository
Written inC
Operating systemWindows, Linux, OS X, Android, iOS, FreeBSD, OpenIndiana, Sailfish OS
TypeVoIP, Instant messaging, Videoconferencing
LicenseGPL-3.0-or-later.
Websitetox.chat Edit this on Wikidata

Tox is a peer-to-peer instant-messaging and video-calling protocol that offers end-to-end encryption. The stated goal of the project is to provide secure yet easily accessible communication for everyone.[2] A reference implementation of the protocol is published as free and open-source software under the terms of the GNU GPL-3.0-or-later.

History

Inception, reference library and new implementation in Rust

An idea of developing a secure peer-to-peer messenger which would later turn into Tox sparked on an anonymous imageboard 4chan[3] amidst the allegations that Skype provided NSA with an access to their infrastructure and encryption, just before they were bought by Microsoft[4][5].

The initial commit to GitHub was pushed on June 23, 2013, by a user named irungentoo.[6] Unofficial community builds became available as early as on August 23, 2013[7], with first official builds made available in October 2013[8]. On July 12, 2014, Tox entered an alpha stage in development and a redesigned download page was created for the occasion[9].

During 2016, original Tox core project saw a steady decline in development activity[10], with the last known commit currently dated Oct 2018[11]. This caused the project to split, with those interested in continuing the development creating a new fork of Tox core[12] called "c-toxcore" around the end of September 2016.

Currently c-toxcore is being developed by a collective known as a TokTok Project[13]. They describe their mission as to "to promote universal freedom of expression and to preserve unrestricted information exchange"[14]. Their current goals are to continue slow iterative development of the existing core implementation, along with in-parallel development of a new reference implementation in Rust[13][15].

Initially, Rust implementation of the protocol library was split in two halves, one handling most of the grunt work of communication with the network, and another one responsible specifically for bootstrap node operation. In December 2022 those were merged, with developers stating that code is now mature enough to support basic communication and bootstrap node operations using TCP connections. As of May 2023 the development is still ongoing, but no client implementations using Rust core library is available yet[15].

Although original core library implementation and its forks have been available for general public for almost a decade, none of them have been reviewed by a competent third-party security researcher.

Back in 2017, WireGuard's author Jason A. Donenfeld opened an issue on project's GitHub page[16] where he stated that c-toxcore is vulnerable to key compromise impersonation (KCI) type of attacks.

He has attributed his find to the fact that Tox is relying on a "homebrew crypto" developed by "non-experts" to facilitate handshakes. He also criticized some other design choices used by Tox developers as well, like using raw ECDH values as an encryption keys.

This report has caused developers to put an additional disclaimer on project's GitHub page[17], stating that Tox is an experimental cryptographic network library that has not been formally audited by an independent third party that specializes in cryptography or cryptanalysis, with a separate disclaimer that users may use it on their own risk.

In March 2023, a post on project's blog[18] stated that one of the community members is working to redesign the cryptographic mechanism used by Tox to perform handshakes using AKE mechanisms used in Noise Protocol Framework. This post also contains a detailed explanation of the original vulnerability.

Features

Encryption of traffic

Users are assigned a public and private key, and they connect to each other directly in a fully distributed, peer-to-peer network. Users have the ability to message friends, join chat rooms with friends or strangers, voice/video chat, and send each other files. All traffic over Tox is end-to-end encrypted using the NaCl library, which provides authenticated encryption and perfect forward secrecy.

Additional messaging features

Tox clients aim to provide support for various secure and anonymised communication features; while every client supports messaging, additional features like group messaging, voice and video calling, voice and video conferencing, typing indicators, message read-receipts, file sharing, profile encryption, and desktop streaming are supported to various degrees by mobile and desktop clients. Additional features can be implemented by any client as long as they are supported by the core protocol. Features that are not related to the core networking system are left up to the client. Client developers are strongly encouraged to adhere to the Tox Client Standard[19] in order to maintain cross-client compatibility and uphold best security practices.

Usability as an instant messenger

Though several apps that use the Tox protocol seem similar in function to regular instant messaging apps, the lack of central servers similar to XMPP or Matrix currently has the consequence that both parties of the chat need to be online for the message to be sent and received. The Tox enabled messengers deal with this in separate ways, some prevent the user from sending the message if the other party has disconnected while others show the message as being sent when in reality it is stored in the sender's phone waiting to be delivered when the receiving party reconnects to the network.[20]

Architecture

Core

The Tox core is a library establishing the protocol and API. User front-ends, or clients, are built on the top of the core. Anyone can create a client utilizing the core.

Technical documents describing the design of the Core, written by the original Tox core library developer irungentoo, are available publicly.[21][22]

Protocol

The core of Tox is an implementation of the Tox protocol, an example of the application layer of the OSI model and arguably the presentation layer. While there's at least one known implementation of the Tox protocol provided by third-party developers[23], it never lived past the prototype stage.

Tox uses the Opus audio format for audio streaming and the VP8 video compression format for video streaming.

Encryption

Tox uses the cryptographic primitives present in the NaCl crypto library, via libsodium. Specifically, Tox employs Curve25519 for its key exchanges, XSalsa20 for symmetric encryption, and Poly1305 for MACs.[24]

Because the tox protocol can be used by many different applications, and because the tox network broadcasts the used client, it is also possible for clients to use additional encryption when sending to clients which support the same features.

Clients

A client is a program that uses the Tox core library to communicate with other users of the Tox protocol. Various clients are available for a wide range of systems.

As of May 2023, according to the sources used to populate the table below, there was only one actively maintained desktop client[25] in existence, authored by a presumably Russian developer[26].

According to their Stack Overflow and Gitlab accounts[27][28], they were at some point an employee of a Russian company supplying CCTV hardware and traffic cameras to various police departments around the Russia[29][30].

Most of previously popular clients like µTox and qTox, in turn, saw a decline in development pace, and has since been abandoned[31] or deprecated[32].

The following list is showcasing most known clients to support Tox, but may be incomplete.[33]

Name Operating system Written in Development status & comments
Antidote[34] iOS Swift Abandoned (see project's GitHub page)
Antox[35] Android Scala, Java Abandoned, last update in August 2019
aTox[36] Android Kotlin Active (last update Feb 2023)
Cyanide[37] Sailfish OS C++ Abandoned,[38] last update in Jan 2017
gTox[39] Linux C++ (GTK+ 3) Abandoned in 2015 (see project's GitHub page)
qTox[40] Linux, FreeBSD, OS X, Windows C++ (Qt) Abandoned in 2023 (see project's GitHub page)
Toxic[41] Linux, FreeBSD, OpenBSD, DragonflyBSD, NetBSD, Solaris, macOS, Android C (Ncurses) Active (last update March 2023)
Toxy[42] Windows C# (WPF) Abandoned (see project's GitHub[43] page)
Toxygen[44] Linux, Windows Python (Qt via PySide) Abandoned (last update March 2020)
TRIfA[45] Android C, Java Active (last update Feb 2023)
µTox[46] Linux, FreeBSD, OS X, Windows C Abandoned (last update Jul 2021)
xWinTox[47] Linux, FreeBSD, Solaris C/C++ (FLTK) Abandoned,[48] last update in Dec 2015
Isotoxin[49] Windows C++ Abandoned[50] last update in Mar 2018
ratox[51] Linux, BSD, OS X C Active [52]
WebTox[53] Web-based HTML5 (client) + Go (server) Abandoned,[54] last update in Jan 2016
yat[25] Linux, Windows, macOS Vala Active (last update in May 2023[55])
Pidgin Linux, Windows C (libpurple plugin) Original version deprecated since May 2017[56]
Latest known fork not maintained since Jan 2020[57]
Miranda NG Windows C++ (plugin) No active development
Last update in Dec 2021[58] (CVE fix, no updates since then)

Disassociation with Tox Foundation

At July 11, 2015, Tox developers officially announced their disassociation with Tox Foundation, due to "a dispute over the misuse of donated funds" by Tox Foundation head and CEO, according to LWN.net.[59] Due to domains being in control of the Tox Foundation, main development of the project was transferred to a new infrastructure, servers, and new domain.

Reception

Tox received some significant publicity in its early conceptual stage, catching the attention of global online tech news sites.[60][61][62][63] On August 15, 2013, Tox was number five on GitHub's top trending list.[64] Concerns about metadata leaks were raised, and developers responded by implementing Onion routing for the friend-finding process.[65] Tox was accepted into the Google Summer of Code as a Mentoring Organization in 2014 and 2015.[66][67]

See also

Wikimedia Commons has media related to Tox clients.

References

  1. ^ "GitHub - TokTok/c-toxcore: The future of online communications". TokTok Project. 2022-03-05. Retrieved 2022-03-05.
  2. ^ "Secure Messaging for Everyone". Tox. Retrieved 6 August 2015.
  3. ^ "Daily reminder that Skype reads the URLs you send, your browser profile, sends encrypted data to Microsoft data centers and gives your conversations to the NSA". 4chan (mirrored). 2013-06-23.{{cite web}}: CS1 maint: url-status (link)
  4. ^ Bogdan Popa (20 June 2013). "Skype Provided Backdoor Access to the NSA Before Microsoft Takeover (NYT)". Softpedia.
  5. ^ Bogdan Popa (31 December 2014). "Leaked Documents Show the NSA Had Full Access to Skype Chats". Softpedia.
  6. ^ "Initial commit". GitHub. Retrieved 18 February 2014.
  7. ^ "Binaries - Tox". 2013-08-23. Archived from the original on 2013-08-23. {{cite web}}: |archive-date= / |archive-url= timestamp mismatch; 2013-10-04 suggested (help)
  8. ^ "Binaries - Tox". 2013-10-04. Archived from the original on 2013-10-04.
  9. ^ "Binaries - Tox". 2014-08-09. Archived from the original on 2014-08-09.
  10. ^ "Commits · irungentoo/toxcore". GitHub. Retrieved 2023-05-18.
  11. ^ "Fix memory leak when closing TCP connection. · irungentoo/toxcore@bf69b54". GitHub. Retrieved 2023-05-20.
  12. ^ "Commits · TokTok/c-toxcore". GitHub. Retrieved 2023-05-18.
  13. ^ a b "The TokTok Project - Home". toktok.ltd. Retrieved 2023-05-18.
  14. ^ "The TokTok Project - Mission". toktok.ltd. Retrieved 2023-05-18.
  15. ^ a b Tox, tox-rs, 2023-05-08, retrieved 2023-05-18
  16. ^ "Tox Handshake Vulnerable to KCI · Issue #426 · TokTok/c-toxcore". GitHub. Retrieved 2023-05-20.
  17. ^ TokTok/c-toxcore, TokTok Project, 2023-05-18, retrieved 2023-05-20
  18. ^ "Redesign of Tox's Cryptographic Handshake – Tox Blog". 2023-03-02. Retrieved 2023-05-20.
  19. ^ "Tox Client Standard". Retrieved 7 November 2015.
  20. ^ "users:troubleshooting - Tox Wiki". wiki.tox.chat. Retrieved 2019-04-26.
  21. ^ "Toxcore Documentation". GitHub. Archived from the original on 20 May 2023. Retrieved 7 November 2015.
  22. ^ "Toxcore Documentation (full copy of a repository saved via web.archive.org)". web.archive.org. 2023-05-20. Retrieved 2023-05-20.
  23. ^ "Xot". GitHub. Retrieved 6 May 2014.
  24. ^ "A New Kind of Instant Messaging". Project Tox. Retrieved 2017-02-15.
  25. ^ a b "yat". GitLab. Retrieved 25 Mar 2022.
  26. ^ "yat's author Gitlab page".{{cite web}}: CS1 maint: url-status (link)
  27. ^ "User НЕВСКИЙ БЛЯДИНА". Stack Overflow. Retrieved 2023-05-18.
  28. ^ "НЕВСКИЙ БЛЯДИНА / lovecry.pt · GitLab". GitLab. Retrieved 2023-05-18.
  29. ^ "О компании". Повышение безопасности дорожного движения (in Russian). Retrieved 2023-05-18.
  30. ^ "Реализованные проекты". Повышение безопасности дорожного движения (in Russian). Retrieved 2023-05-18.
  31. ^ "uTox Github: last known commits".
  32. ^ "chore: update README with archive message · qTox/qTox@14fbfd4". GitHub. Retrieved 2023-05-18.
  33. ^ "Client". Tox clients. Retrieved 17 January 2021.
  34. ^ "Antidote". Retrieved 6 August 2015.
  35. ^ "Antox". Github. Retrieved 6 August 2015.
  36. ^ "Atox". Github. Retrieved 22 January 2021.
  37. ^ "Cyanide". Github. Retrieved 3 January 2016.
  38. ^ "Last commit in Cyanide's repo". GitHub. Retrieved 12 April 2018.
  39. ^ "gTox". Github. Retrieved 7 November 2015.
  40. ^ "qTox". Github. Retrieved 21 February 2023.
  41. ^ "Toxic". Github. Retrieved 22 January 2021.
  42. ^ "Toxy". Github. Retrieved 6 August 2015.
  43. ^ "Toxy repo". GitHub. Retrieved 12 April 2018.
  44. ^ "Toxygen". Github. Retrieved 2016-07-01.
  45. ^ "TRIfA". Github. Retrieved 11 May 2018.
  46. ^ "µTox". Github. Retrieved 7 November 2015.
  47. ^ "xWinTox". Tox-Wiki. Retrieved 7 November 2015.
  48. ^ "Last commit in xWinTox repo". GitHub. Retrieved 12 April 2018.
  49. ^ "Isotoxin". Tox-Wiki. Retrieved 21 July 2017.
  50. ^ "Last commit in the isotoxin repo". Github. Retrieved 21 August 2020.
  51. ^ "ratox". 2f30. Retrieved 26 July 2018.
  52. ^ "commit log of the ratox repo". 2f30. Retrieved 5 January 2023.
  53. ^ "WebTox". GitHub. Retrieved 6 September 2017.
  54. ^ "Last commit in the WebTox repo". GitHub. Retrieved 12 April 2018.
  55. ^ "Commits · master · НЕВСКИЙ БЛЯДИНА / yat · GitLab". GitLab. 2023-05-08. Retrieved 2023-05-20.
  56. ^ "The end. · fizyk20/tox-prpl@d8de76a". GitHub. Retrieved 2023-05-20.
  57. ^ "Commits · EionRobb/tox-prpl". GitHub. Retrieved 2023-05-20.
  58. ^ "Tox protocol". forum.miranda-ng.org. Retrieved 2023-05-20.
  59. ^ "A split within the Tox project". LWN.net. Nathan Willis. 15 July 2015. Retrieved 14 February 2016.
  60. ^ Kar, Saroj (5 August 2013). "Tox: A Replacement For Skype And Your Privacy?". Silicon Angle. Retrieved 19 February 2014.
  61. ^ Grüner, Sebastian (30 July 2013). "Skype-Alternative Freier und sicherer Videochat mit Tox" [More free and secure video chat with Tox]. Golem.de (in German). Retrieved 19 February 2014.
  62. ^ "Проект Tox развивает свободную альтернативу Skype" [Tox project develops free Skype replacement]. opennet.ru (in Russian). 30 July 2013. Retrieved 19 February 2014.
  63. ^ Nitschke, Manuel (2 August 2013). "Skype-Alternative Tox zum Ausprobieren" [Tox Skype replacement tested]. heise.de (in German). Retrieved 19 February 2014.
  64. ^ Asay, Matt (15 August 2013). "GitHub's new 'Trending' Feature Lets You See The Future". ReadWrite.com. Retrieved 19 February 2014.
  65. ^ "Prevent_Tracking.txt". GitHub. Retrieved 20 February 2014.
  66. ^ "Project Tox". GSoC 2014. Retrieved 7 March 2015.
  67. ^ "Project Tox". GSoC 2015. Retrieved 7 March 2015.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Tox_(protocol)&oldid=1155975734"