3
Signal Protocol in Rust (programming.dev)
submitted 2 weeks ago by to c/rust@programming.dev
9 comments fedilink hide all child comments
 

I wanted to implement the Signal protocol for a series of secure messaging apps I’m working on, so I built this project to test and use in my own work. It’s still far from finished, but I think it’s at a stage where it’s worth sharing with the community.

IMPORTANT DISCLAIMER: This project is not professionally audited and is not production-ready. I do not recommend anyone use this in their own code yet. It is provided strictly for testing, experimentation, and demo purposes. I used AI as an assistant to help build this, so double-check everything before taking it seriously.

Project Links:

Current Status & Development:

  • Spec Alignment: The goal is to fully align with the official Signal protocol spec.
  • Testing: It includes unit tests, but due to WASM testing limitations, I also added a Storybook-like UI to run and test it directly within a browser environment.
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 2 weeks ago (3 children)

You used LLMs, right?

How did you manage to review all this?

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] [S] 2 points 2 weeks ago (2 children)

    thats right. i used LLM's. i reviewed this thoroughly myself. there are some in-house documents published on the website. for exmples threat-models, formal-verification and security audits. they are good for internal review but fundamentally invalid because its like "trust me bro"... and you shouldnt need to.

    i would like to aim for a third-party review from an org like ROS or NLNet, but open source support isnt easy to come by on project as complicated as this. im sure many orgs are overwhelmed by AI slop and i've failed to make the cut several times, so im not expecting a professiona audit any time soon.

    feel free to reach out for clarity on the details if you would like to investigate it further.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 weeks ago (1 child)

    I mean on code level. How did you make sure, the LLM prints out something maintainable, understandable?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 2 points 2 weeks ago*

    the typical software development approach: unit tests, reviewing PR changes, documenting details and CI/CD (to mention a few steps). its not something i can easily enumerate because in cybersecurity there are countless nuances to consider, which is how we end up with formal verification documents and security audits. all the internal documents are useful for me, but essentially geared toward being a starting point for a third-party reviewer.

    the impementation here is being used in a couple functional messaging apps (similarly unaudited and unreviewed):

    i will also be adding it to an open source project soon as seen at: https://github.com/positive-intentions/chat to give that e2e open-source transparency in the implementation.

  • permalink
  • fedilink
  • source
  • parent