FiSHLiM

FiSHLiM is a XChat / HexChat plugin for FiSH IRC encryption. It's my attempt at making a simple and lightweight plugin for this encryption protocol. FiSHLiM is 100% free and open source software!

WARNING: FiSH encryption is not secure. See the security section below.

NOTE: A modified version of FiSHLiM is now bundled with HexChat. If you use HexChat you should generally not install this plugin (and if you do you need to remove the bundled version of FiSHLiM).

Features

Working:

Sending/receiving messages
Topic decryption
Using unecrypted keys / keys without a password from blow.ini
Pure protocol-level filtering (works with highlighting, nick coloring etc)
Partially encrypted messages (e.g. prefixed with nickname by a bouncer)

Not working:

Key exchange
Password-protected key storage
Topic encryption
/me message encryption
Remote exploitation (hopefully!)

If you need feature 1-3 you should try out this FiSH plugin in Python. Or even better, write a patch for FiSHLiM ;)

Security warning!

FiSH encrypts your messages in ECB mode (in other words, in independent blocks). If the same block appears two times it will be encrypted the same way both times.

So, never give untrusted people unencrypted chat logs if they also have the encrypted version! Then they can decrypt the messages if they appear again. Also, it's possible to make statistical attacks or replay attacks. A better encryption mode will be implemented later! ~~[do . n0t . click here]~~

Get the source

Use GIT to stay up to date, or download a snapshot as a bz2 archive. You can also browse the code online.

git://git.fishlim.kodafritt.se/fishlim.git

Installation instructions

Install on Ubuntu and Debian
Install on Mac OSX

Remember that HexChat comes with a modified version of FiSHLiM bundled with it.

Similar plugins

FiSH from secure.la (has unpatched security exploits)
FiSH for XChat in Python
(seems to have better FiSH support than FiSHLiM, please try it out also!).
Mircryption/XChat

Here's a back up of the Python plugin in my GIT repository, in case the link would stop working.