4 ms·
Crap, this is more severe than I anticipated. I'll think about it, and probably change the code and API. That's said, I don't understand why DJB says this is
by loup-vaillant 10y ago
Crap, this is more severe than I anticipated. I'll think about it, and probably change the code and API.
That's said, I don't understand why DJB says this is unnecessary for Diffie-Hellman? I mean, an all-zero shared secret sounds pretty bad, doesn't it?
Or is it because DJB assumes that if one party decides to publish the communication, it can do so anyway?
- lvh 10y agoNot all AKEs require contributory behavior to guarantee their security properties, but many do. Your suggestion is pretty close to why; if you're using plain scalarmult as opposed to an AKE with fancier properties (say, 3DH, HMQV...) in the context of e.g. box, it's the sender that picks public keys anyway, so they don't care. In the context of most transport encryption, you presumably do want to prevent those keys from being selected by either party. That means either filtering those keys, or, perhaps better, using a fancier AKE like the 3DH in Signal/Noise or HMQV or something.