Whether the chat key is secure

[ShareTheWorld]

const id = ${community.publicKey}${uuid}
const contentTopic = idToContentTopic(id)
const symmetricKey = await generateKeyFromPassword(id)

return new Chat({
  client,
  uuid,
  id,
  contentTopic,
  type,
  symmetricKey,
  description,
})

Your public Key and uuid are concatenated into ids. Then hashes Keccak256(id) with the id to get the contentTopic. Finally use PBKDF2(id) to get the chat key.
Since Publickeys and uuid are public, are topic and key unsafe?

[felicio]

Hi, the snippet applies to channels and can technically be used by anyone to read messages of Communities that don't have the Encrypted option enabled.

The web client is till missing the encryption layer which would allow it to support this type of Communities.

Desktop app, on the other hand, already supports them and uses a "Hash Ratchet" algorithm, a double ratchet variant, for it.

More info at:

• https://github.com/status-im/status-go/blob/d70d3cdf8c92a786a9fbfab7d2295547546f2aed/protocol/encryption/README.md
• https://github.com/status-im/status-go/blob/d70d3cdf8c92a786a9fbfab7d2295547546f2aed/protocol/messenger_communities.go#L1044
• https://github.com/status-im/status-go/blob/d70d3cdf8c92a786a9fbfab7d2295547546f2aed/protocol/encryption/encryptor.go#L667
• https://github.com/status-im/status-go/blob/d70d3cdf8c92a786a9fbfab7d2295547546f2aed/protocol/common/message_sender.go#L273
• https://github.com/status-im/status-go/blob/d70d3cdf8c92a786a9fbfab7d2295547546f2aed/protocol/common/message_sender.go#L295

– https://discord.com/channels/864066763682218004/865466680129880074/1058202405583474688

[felicio]

Follow up #324