4 ms·

Actually this is not correct, you can also use key which is destroyed on lock.

upofadown 6y ago
For instant messaging you need to be able to receive messages even when the phone is locked. So the key material can't be destroyed and must be left exposed. You could encrypt old messages separately, but the result would end up being very inconvenient.
- dwighttk 6y ago
  > For instant messaging you need to be able to receive messages even when the phone is locked. Why?
- bigiain 6y ago
  You can receive encrypted messages and store them while locked. You only need the key material when reading the messages, which then uses the apps unlock pin to retrieve the key material from the Secure Enclave. Quite how Signal deals with notifications I’m not sure, perhaps your right and the encryption key s persistent while the app is in the background so it can show you the sender and message on the Lock Screen? But it doesn’t _have_ to be that way. Wickr (which I trust way less than Signal) seems to at least have its UI set up to imply that’s what it’s doing.
  - upofadown 6y ago
    Fair enough, but my point still remains. You need the key material any time the phone is unlocked. Because we are doing instant messaging that is going to be a lot more exposure time than with some sort of offline system.
    - bigiain 6y ago
      You should be able to lock that down to “only while the messaging app is in the foreground”, which limits the exposure time further, but certainly not to zero. Hopefully, if you care about this, you use and app which can be configured to have its own passphrase/pin which hopefully is used to access properly secured keys from the Secure Enclave only when that’s entered. (Signals interface works like this. I’m only assuming/hoping it’s working that way underneath).
- bluesign 6y ago
  You can still have keys to access and decrypt messages (for notification purposes) you don't need to save them to db instantly. This is a trade off between server load and security.

For instant messaging you need to be able to receive messages even when the phone is locked. So the key material can't be destroyed and must be left exposed. You could encrypt old messages separately, but the result would end up being very inconvenient.

dwighttk 6y ago
> For instant messaging you need to be able to receive messages even when the phone is locked. Why?
bigiain 6y ago
You can receive encrypted messages and store them while locked. You only need the key material when reading the messages, which then uses the apps unlock pin to retrieve the key material from the Secure Enclave. Quite how Signal deals with notifications I’m not sure, perhaps your right and the encryption key s persistent while the app is in the background so it can show you the sender and message on the Lock Screen? But it doesn’t _have_ to be that way. Wickr (which I trust way less than Signal) seems to at least have its UI set up to imply that’s what it’s doing.
- upofadown 6y ago
  Fair enough, but my point still remains. You need the key material any time the phone is unlocked. Because we are doing instant messaging that is going to be a lot more exposure time than with some sort of offline system.
  - bigiain 6y ago
    You should be able to lock that down to “only while the messaging app is in the foreground”, which limits the exposure time further, but certainly not to zero. Hopefully, if you care about this, you use and app which can be configured to have its own passphrase/pin which hopefully is used to access properly secured keys from the Secure Enclave only when that’s entered. (Signals interface works like this. I’m only assuming/hoping it’s working that way underneath).
bluesign 6y ago
You can still have keys to access and decrypt messages (for notification purposes) you don't need to save them to db instantly. This is a trade off between server load and security.