3 ms·
Not sure I understand. My impression was that the end-to-end encryption algorithm was probably the most secure thing about Signal, allowing strong encryption be
by barbs 4y ago
Not sure I understand. My impression was that the end-to-end encryption algorithm was probably the most secure thing about Signal, allowing strong encryption between sender and recipient without relying on trust of the central server. Regardless of where or how it was developed, it's open-source.
- nunobrito 4y ago99.9% of the algorithms are open source, that is still no reason for them to be trusted since it takes years and years (sometimes decades) until exploits included by design are revealed: https://www.theverge.com/2013/9/11/4718694/how-far-did-the-nsa-go-to-weaken-cryptography-standards https://www.theverge.com/2013/9/11/4718694/how-far-did-the-n... Trivia: What percentage of open source end-to-end encryption algorithms were developed by coincidence next door to the NSA headquarters?
- barbs 4y agoReading into that article, it looks like the NSA made a random-number generation algorithm standard, but upon inspection by cryptographers it was seen to be suspect due to its unclear origin of particular constants, and this was discovered as soon as the standards were published [0]. It was also slow compared to other standards, and as a result it was never widely adopted. By contrast, I can't find any significant security criticisms about Signal's double-ratchet algorithm, nor anything that would suggest that some sort of bad actor is pushing it to become standard. It seems to me like it was widely adopted because it's a solid end-to-end encryption algorithm. I also couldn't find where the algorithm was developed. If you have any sources for this I'd be glad to read it. [0] https://www.wired.com/2007/11/securitymatters-1115/ https://www.wired.com/2007/11/securitymatters-1115/