REMail

So I started designing the main UI for REMail; however, I discovered that Lanterna (the TUI library I used) wasn’t the best for this because it couldn’t handle too many things on the screen. So I decided to switch to Compose Multiplatform. However, figuring out how to use Compose was a complete pain. The documentation is nowhere near friendly, not to mention that you have to go to the Google documentation. I actually don’t know how someone can look at it and say, “Oh yeah, this is fine.” Anyway, after a few hours of pain, I figured out how to use navigation, inputs, buttons, and alerts.

Even though there aren’t any new features, at least the UI looks very good and friendly now. Also, don’t ask why the default primary color looks like that, but I figured that just changing that would take another 5 hours of researching.

Made register and login actually work and go through. It uses Libsodium for cryptography. The way it works is it derives a key from the password using Argon2id and then derives 2 subkeys using KDF. 1 of the keys is used to seed a signature key (ed25519). The public key is shared with the server when one registers. When one wants to log in, they do the same process: ask the server for a challenge, sign the challenge, and send it back to the server. The server uses this to verify one’s password without having to send the password to the server. The other KDF subkey is then used to decrypt the master key, and the master key is used to decrypt the encryption and signature keys that will be used for email sending.

This solution is not the greatest, because if the database gets leaked, it is possible to do an offline attack by computing the KDF subkeys for random passwords and see if any of them give a public key that’s in the database.

The idea of REMail was in my head for 2 months; however, I didn’t really start working on it apart from figuring the design out. So now I decided to continue it. I began by making the registration. I also made a TUI client for it, which you can see below. It doesn’t do much yet; however, it can generate the keys and encrypt them like a password manager.