3 ms·

From here: * https://signal.org/docs/specifications/x3dh/ https://signal.org/docs/specifications/x3dh/ ... I understand that the prekeys are signed. I will co

From here: * https://signal.org/docs/specifications/x3dh/ https://signal.org/docs/specifications/x3dh/ ... I understand that the prekeys are signed. I will confess that I have no deep understanding of how everything works together. Signal protocol is somewhat baroque.

tialaramex 5y ago
The (signed) prekeys are public information about a user, although unlike their long term Identity key the prekey is replaced periodically to help ensure Forward Secrecy. The signature means Alice knows she was given Bob's real public prekey and not a fake, but she doesn't get a different prekey (or signature) than Charlie or Deborah if they ask in roughly the same time period. A loose equivalent in the OpenPGP world would be a user's temporary encryption keys, which may change sometimes while your signing key stays unchanged. I don't know how common this practice is today, I know it was common years ago. Clearly knowing Alice's most recent temporary encryption public key, signed by Alice's signing key, would not prove a message you showed me was from Alice. > Signal protocol is somewhat baroque. I agree it seems more complicated in principle than OpenPGP, although I think it's hard to make that argument for the practical deployment of OpenPGP because of the complexity of delivering compatibility. But Signal's complexity has a specific purpose. For example those three DH pairs are combined together with a KDF so that 1. Bob learns whether the message is really from Alice (assuming Bob is not the protagonist of the movie Memento and so remember if he forged the message); 2. Alice knows the message can only be received by Bob (to the extent she verified Bob's identity, which is an out-of-band problem), and 3. A fresh random Forward Secret key is used for the conversation. Three desired properties, run DH three times. It is definitely possible that cryptographers will come along and say "Oh, we can do this in a single function" and write like fifty pages of difficult maths and one day we get a replacement for Signal with "simpler" (although like Elliptic Curve maybe not simpler to explain) cryptography than this. Definitely possible, but these moving parts all have a purpose AFAIU today.
- deleted 5y ago
  [deleted]

tialaramex 5y ago

The (signed) prekeys are public information about a user, although unlike their long term Identity key the prekey is replaced periodically to help ensure Forward Secrecy. The signature means Alice knows she was given Bob's real public prekey and not a fake, but she doesn't get a different prekey (or signature) than Charlie or Deborah if they ask in roughly the same time period. A loose equivalent in the OpenPGP world would be a user's temporary encryption keys, which may change sometimes while your signing key stays unchanged. I don't know how common this practice is today, I know it was common years ago. Clearly knowing Alice's most recent temporary encryption public key, signed by Alice's signing key, would not prove a message you showed me was from Alice. > Signal protocol is somewhat baroque. I agree it seems more complicated in principle than OpenPGP, although I think it's hard to make that argument for the practical deployment of OpenPGP because of the complexity of delivering compatibility. But Signal's complexity has a specific purpose. For example those three DH pairs are combined together with a KDF so that 1. Bob learns whether the message is really from Alice (assuming Bob is not the protagonist of the movie Memento and so remember if he forged the message); 2. Alice knows the message can only be received by Bob (to the extent she verified Bob's identity, which is an out-of-band problem), and 3. A fresh random Forward Secret key is used for the conversation. Three desired properties, run DH three times. It is definitely possible that cryptographers will come along and say "Oh, we can do this in a single function" and write like fifty pages of difficult maths and one day we get a replacement for Signal with "simpler" (although like Elliptic Curve maybe not simpler to explain) cryptography than this. Definitely possible, but these moving parts all have a purpose AFAIU today.

deleted 5y ago
[deleted]