3 ms·
This isn't a great post for explain the simple elegance of Axolotol. There probably needs to be one. My favorite parts comes from combining of Diffie–Hellman o
by zmanian 11y ago
This isn't a great post for explain the simple elegance of Axolotol. There probably needs to be one.
My favorite parts comes from combining of Diffie–Hellman operations on both long term and ephemeral keys to integrate identity verification and creation of deniable shared secret into one operation.
It's a really elegant extension of NaCL's secret box to include Perfect Forward Secrecy.
There are some things that are objectionable.
GPL licensing makes Open Whisper Systems a gate keeper to using the battle tested code base for most users. This is probably unnecessary. It isn't that hard to implement yourself giving a working curve library.
We need to better explain to developers with Ellitic Curve Crypto and Curve25519 aren't scary just because the math is a little unfamiliar and that RSA and integer field Diffie Hellman are code smell.
- NateLawson 11y agoThe reason it works so well is that Trevor started with the question "why is OTR so complicated?" and began removing parts until he had the minimum. Then, he looked at that and built a completely different protocol that achieved the same goals but where every part mattered. That's usually the sign of a good crypto design -- every bit of the message and computation is vital and can't be removed without everything else falling apart. Excessive round trips, duplicate fields, data sent twice -- these are all signs of a lousy design that probably has security flaws.
- dvanduzer 11y agoIt would be a far simpler crypto design if it didn't insist on deniability as a feature. OTR always operated in a weird niche, but it solved a specific problem for IM that everyone had. But simpler / more elegant protocols don't always win, and never because of the quality of the crypto. For example: https://en.wikipedia.org/wiki/Simple_public-key_infrastructure https://en.wikipedia.org/wiki/Simple_public-key_infrastructu...
- rosser 11y agoIf you need deniability, you need it. Like, your life could literally depend on having it. I'd say that justifies some protocol complexity.
- zmanian 11y agoMost of the protocols with forward secrecy and non-deniability also require synchronous communication to agree on ephemeral keys. Deniability is almost a nice side effect of the asynchronous design. It doesn't seem like it adds tremendous complexity unto itself.