20 ms·
Can't end-to-end decryption be defeated by recording the original private key when the exchange first happens? I assume most of these services don't require the
by atomical 9y ago
Can't end-to-end decryption be defeated by recording the original private key when the exchange first happens? I assume most of these services don't require the two participants to exchange a shared secret in the meatspace?
- tim333 9y agoPresumably so, though I doubt WhatApp would be keen to have the app send your private key to the security services. Still maybe that's the kind of thing Rudd is thinking of.
- biot 9y agoThat's just end-to-end with key escrow. Little different than a backdoor at that point.
- ThrustVectoring 9y agoThe private key never needs to get sent and can be generated by the user's device. The public key gets verified through the channel to detect and prevent man-in-the-middle attacks. To defeat end-to-end encryption, you need to defeat the ends.
- TazeTSchnitzel 9y agoNo, because of public key cryptography. Neither side ever exchanges private keys in the clear.
- tlrobinson 9y agoNot necessarily, but you would need to authenticate the keys somehow, e.x. by voice (Signal: https://theintercept.com/2016/07/02/security-tips-every-signal-user-should-know/#verify https://theintercept.com/2016/07/02/security-tips-every-sign...) or otherwise out-of-band.
- satysin 9y agoThis is why we have things like Diffie–Hellman key exchange https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...