<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<div class="moz-text-flowed"
style="font-family: -moz-fixed; font-size: 13px;" lang="x-western">On
02/03/2010 17:11, Ian Goldberg wrote:
<br>
<blockquote type="cite" style="color: rgb(0, 0, 0);">On Tue, Mar 02,
2010 at 01:44:05PM +0000, Vladimir wrote:
<br>
<blockquote type="cite" style="color: rgb(0, 0, 0);">Hello,
<br>
<br>
I'm currently using fingerprints to identify clients using my
<br>
application on their mobile phones. The application uses J2ME.
<br>
</blockquote>
Cool; which application is this?
<br>
<br>
<blockquote type="cite" style="color: rgb(0, 0, 0);">I am interested
in using SMP but I doubt it will be possible because
<br>
of the computationally intense calculations (power in particular).
<br>
The example in the documentation talks about its uses on a
<br>
BlackBerry, but the aim of my software is to be used on less powerful
<br>
devices too. What effects on performance will SMP have on a less
<br>
powerful processor?
<br>
</blockquote>
In regular OTR conversation, 2 modexps (the expensive operation) are
<br>
done every time one of the parties creates a new temporary encryption
<br>
key, which is generally done approximately every message.
<br>
</blockquote>
My protocol is different from OTR in that respect. It uses public key
encryption to exchange a symmetric key, which is used for the duration
of the conversation. Both clients (A and B) have to generate a pair for
every application startup. If A wants to speak to B, then A encrypts a
freshly generated symmetric key using B's public key. Along with the
encrypted symmetric key, A sends a hash fingerprint of both public keys
to B. Then A and B have to contact each other to confirm the
fingerprint. By confirming the fingerprint, we know that no MITM attack
has taken place, since the keys used for encrypting them are the
correct ones. In a way A says "I encrypted the symmetric key using this
public key, is that ok?".
<br>
<blockquote type="cite" style="color: rgb(0, 0, 0);">In SMP, each side
does about 9 modexps, but only once per person you
<br>
talk to. So I'd say SMP should take way less power than the rest of
the
<br>
conversation.
<br>
</blockquote>
I'm not familiar with the modexps measurements but it seems to me that
using 1536-bit primes is still more than generating a single RSA
key-pair, which is enough of a burden right now. Please correct me if
I'm wrong.
<br>
<br>
The application is not released yet, it is a project I'm working on at
the moment for my dissertation. I'm glad to see interest in it.
<br>
<br>
Thanks
<br>
</div>
</body>
</html>