3 ms·

One thing I wish signal had is key transparency. How come I can't see my own key hash and my contacts keys? I know they'r trying to keep it simple, but power us

One thing I wish signal had is key transparency. How come I can't see my own key hash and my contacts keys? I know they'r trying to keep it simple, but power users should be able to do this.

codethief 6y ago
But you can? Open a conversation -> Menu -> Conversation settings -> View safety number. Note that the safety number is basically a combination of your and your contact's (DHKE-negotiated) keys and is thus going to be different for every conversation. The reason both keys are not shown separately is that it apparently confused users.
- exabrial 6y ago
  Interesting, and thanks! Normally DHKE is authenticated though with public key cryptography? The way I understand is DHKE establishes a secret... with someone but in order to ensure it was your intended party, not a hostile government, usually a public key signature exchange takes place.
  - codethief 6y ago
    That's correct, it's an authenticated Diffie-Hellman key exchange. I'm not sure why they don't show the actual public keys anywhere but I suppose it doesn't make a lot of sense for the general public and it'd only be confusing. In fact, the cryptography is even more complicated: The Signal protocol uses a so-called double ratchet algorithm[0] which derives from the session/conversation keys a new ephemeral message key whenever possible (again using a DHKE). This has the added advantage of providing forward secrecy. [0]: https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm
pa7ch 6y ago
They have a feature called safety numbers in the conversation settings. Lets you pull up a QR code and number so you can verify public keys with someone in person or out of band. Then if you hit a verify button which i assume makes the warnings for someone's key changing louder or something like that.

3 ms·

One thing I wish signal had is key transparency. How come I can't see my own key hash and my contacts keys? I know they'r trying to keep it simple, but power us

by exabrial 6y ago

One thing I wish signal had is key transparency. How come I can't see my own key hash and my contacts keys? I know they'r trying to keep it simple, but power users should be able to do this.

codethief 6y ago
But you can? Open a conversation -> Menu -> Conversation settings -> View safety number. Note that the safety number is basically a combination of your and your contact's (DHKE-negotiated) keys and is thus going to be different for every conversation. The reason both keys are not shown separately is that it apparently confused users.
- exabrial 6y ago
  Interesting, and thanks! Normally DHKE is authenticated though with public key cryptography? The way I understand is DHKE establishes a secret... with someone but in order to ensure it was your intended party, not a hostile government, usually a public key signature exchange takes place.
  - codethief 6y ago
    That's correct, it's an authenticated Diffie-Hellman key exchange. I'm not sure why they don't show the actual public keys anywhere but I suppose it doesn't make a lot of sense for the general public and it'd only be confusing. In fact, the cryptography is even more complicated: The Signal protocol uses a so-called double ratchet algorithm[0] which derives from the session/conversation keys a new ephemeral message key whenever possible (again using a DHKE). This has the added advantage of providing forward secrecy. [0]: https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm
pa7ch 6y ago
They have a feature called safety numbers in the conversation settings. Lets you pull up a QR code and number so you can verify public keys with someone in person or out of band. Then if you hit a verify button which i assume makes the warnings for someone's key changing louder or something like that.