3 ms·
How is this not giving the server chance to insert its own keys and not the ones user generated? Because the server can't sign the key exchange messages - the
by caf 11y ago
How is this not giving the server chance to insert its own keys and not the ones user generated?
Because the server can't sign the key exchange messages - the private key is generated on the client and never leaves it.
- acqq 11y agoSo would everything be safe if the server is controlled by an attacker and the attacker can also act as MtM for the communication data? Is there any analysis/verification of the full protocol and/or whole process of TextSecure/Signal as they are commonly used? I'd greatly appreciate the link.