4 ms·
One field of cryptography that only recently because available is deniable cryptography. Basically how it works is, for every message from sender->receiver, eit
by anchpop 5y ago
One field of cryptography that only recently because available is deniable cryptography. Basically how it works is, for every message from sender->receiver, either the sender or the receiver can sign it, but nobody can tell who. That way, you always know the (signed) messages you receive are real, but you can’t prove their authenticity to anyone else. You know they’re real because it could only be from the sender or from the receiver, and you’re the receiver, and you would remember if it was you, so it must be from them. But you can’t turn around and show that message to anyone else to incriminate the sender - it could just as easily have been forged by you to frame them.
(And actually the best deniable cryptography schemes are even better than that, but for difficult to explain reasons)
Right now, if you really want to message securely, first of all you need to make sure your messaging app has E2E and perfect forward secrecy. Even better, it should be configured to automatically delete the perfect-forward-secrecy keys after some time, to limit the damage if your phone gets seized (only the messages from the past x days could be recovered). Signal has an option for that and it’s really nice. But I think the next wave is actually going to be deniability - not just at a crypto level, but at a ui level, so users can easily add fake messages from themselves or their conversation partner at any time in the past that are indistinguishable from real ones, making the practice of “leaking screenshots” irrelevant (or at least still no better than he-said-she-said). You don’t strictly need deniable cryptography to implement this but it would be the icing on the cake
- formerly_proven 5y agoMost (interactive) protocols have non-non-repudiation, because it's easier and faster to implement. If you wanted to tie messages to either the sender, or the receiver, you'd need to sign them, which is way more expensive than a MAC or authenticated encryption.
- lmm 5y agoYou usually want to authenticate the sender, both to make it harder for attackers to learn anything by sending you chosen ciphertexts and because users actually want to know who they're talking to. And if you're doing that, then that authentication will be non-repudiable unless you go out of your way to make it repudiable.
- deleted 5y ago[deleted]
- tialaramex 5y agoUnless your users are the protagonist of the Hollywood movie "Memento" they already know whether they sent a message, so, you can simply arrange that both parties have the keys needed to encrypt any authentic message. The user knows they didn't send it, so the apparent sender must have. But nobody else can reach the same conclusion. That is, if you show me a message purporting to be from Steve to Jenny in a well-designed modern protocol and give me access to Jenny's cryptographic materials, I can't be sure whether it is really a message Steve sent, or merely a message Jenny forged pretending to be from Steve.
- upofadown 5y agoDeniability though forgery doesn't really affect the traceability issue. If the police have good reason to think you originated a particular message they can just seize your phone and do forensics on it. Chances are they will find traces. Failing that they can just find a single person who will testify that you sent them a particular message, which with forgeablity they can state with certainty. A prudent rumour mongerer would simply not sign the messages in the first place...
- vlovich123 5y agoIs this new? I feel like OTR had a version of this where after some time both parties would advertise their keys allowing anyone to create forgeries. Maybe slightly different implementation but feels like a very similar overarching concept.
- throwaway81523 5y ago> One field of cryptography that only recently because available is deniable cryptography. Basically how it works is, for every message from sender->receiver, either the sender or the receiver can sign it, but nobody can tell who. If you mean what I think you do, Dan Bernstein described how to do that back in 2001: https://groups.google.com/g/sci.crypt/c/73yb5a9pz2Y/m/LNgRO7IYXOwJ https://groups.google.com/g/sci.crypt/c/73yb5a9pz2Y/m/LNgRO7...