3 ms·
For anyone curious, I spent a lot of time describing the protocol in intuitive ways[2] in the book Real-World Cryptography[1]. Having spent a lot of time revie
by baby 6y ago
For anyone curious, I spent a lot of time describing the protocol in intuitive ways[2] in the book Real-World Cryptography[1].
Having spent a lot of time reviewing Signal and secure messaging applications as part of my job, I wanted to be able to explain how the protocol worked in the most educative way possible. feedback is welcomed :D
[1]: https://www.manning.com/books/real-world-cryptography?a_aid=Realworldcrypto&a_bid=ad500e09 https://www.manning.com/books/real-world-cryptography?a_aid=...
[2]: https://livebook.manning.com/book/real-world-cryptography/chapter-10/v-10/ https://livebook.manning.com/book/real-world-cryptography/ch...
- schoen 6y agoYour book looks really cool! It says it's officially coming out in the spring?
- dessant 6y agoHi! Some of my peers have enabled Signal PINs when the feature was introduced, and they have used weak PIN codes that they could remember on the spot, because intially the app would not let them view their messages until the Signal PIN was configured, which was later fixed in an app update. What is the real-world impact of a weak Signal PIN code? Can a compromised Intel SGX process or the Signal server intercept our messages, if the PIN code is known?
- tptacek 6y agoNo, even with a compromised PIN and an SGX break, attackers can't recover messages. The PIN (and SGX) protects your contact list, something other messengers (like Wire) tend to simply keep in plaintext databases.
- codethief 6y agoThis might change, though, because AFAIR Moxie said that they were looking into using Secure Value Recovery for message synchronizing between different clients (mobile, desktop), too.