3 ms·
If you are using a temporary shared secret then after you forget that shared secret you will need a new secret which you will have to generate. I mean nothing m
by upofadown 5y ago
If you are using a temporary shared secret then after you forget that shared secret you will need a new secret which you will have to generate. I mean nothing more than that.
- tptacek 5y agoRight, why would anyone ever be better off holding that temporary secret over many messages and many days?
- upofadown 5y agoMy entire point is that it is not really necessary to do shared secret generation at any but a very slow rate. Even if you don't so it the Signal protocol way it is still perfectly reasonable to only do it once in a while. That might be a short while but it could reasonably be quite long.
- tptacek 5y agoWhy is it reasonable to only do shared secret generation once in awhile? What's the win to doing that? The win to not doing it is that it narrows the blast radius of a single key compromise to a small number of messages (or, in full ratchets, to a single message). Why would I ever, ever want to increase the blast radius of a key?
- a1369209993 5y ago> What's the win to doing that? The win is that you spend less processing power on elliptic-curve cryptographic operations. Just like (even if RSA didn't have all its other problems) there's a win to using ECC instead of X-thousand-bit RSA.
- lmm 5y agoOn the assumption that it's expensive (I don't know if it's true or not, but upofadown said so explicitly and you didn't contradict them), the win is saving that expense. Obviously if you can reduce the blast radius for free then you do so, but if it's not free then it's reasonable to ask how big the difference between one message/several messages/a week's worth of messages is in your threat model.
- tptacek 5y agoIt is not expensive.