6 ms·

forward secrecy, for one: https://signal.org/blog/asynchronous-security/ https://signal.org/blog/asynchronous-security/

aborsy 4y ago
You use hardware keys and don’t care about forward secrecy. Private key never leaks. For offline file encryption ( pgp isn’t intended for messaging).
- hiq 4y ago
  > You use hardware keys and don’t care about forward secrecy. Private key never leaks. I guess you mean "leak" as in "being copied", which relies on how good the hardware actually is at preventing this, but what if I just lose my hardware key, isn't that the same?
upofadown 4y ago
Forward secrecy is somewhat overrated in end to end encrypted messaging. Most people do not want a truly off the record experience but instead keep their old messages around indefinitely. As long as those old messages exist and are accessible to the user they will be just as accessible to any attacker that gets access to the secret key material. The Signal Protocol somewhat excessively provides forward secrecy for each and every message sent. That is sort of pointless while the messages still exist on the screen. Most people would be happy getting rid of their old messages every week or so. You could totally do that in an instant messaging system that used OpenPGP formatted messages. The reason that no one bothers is because few people want to dump their old encrypted emails. No one wants to dump their old encrypted files. Instead they take advantage of the greater security inherent in an offline encryption system and avoid getting their keys leaked in the first place. If you really wanted to do message by message forward secrecy using a hash ratchet using OpenPGP formatted messages you could do that too. There is nothing magical about the Signal Protocol for stuff like that... Relevant discussion: * https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy
- RunSet 4y ago
  > The Signal Protocol somewhat excessively provides forward secrecy for each and every message sent. That is sort of pointless while the messages still exist on the screen. Or if the message's recipient took a screenshot.
- wizeman 4y ago
  I thought the point of forward secrecy in end-to-end encrypted messaging was to protect past conversations at the transport layer against the key being compromised? In other words, the point being that a man-in-the-middle attacker cannot decrypt past conversations that he recorded even if in the future he is able to determine the key? It's kind of obvious that you cannot prevent the other party from saving the messages, but from what I understand I don't think that's what forward secrecy is even trying to do (disclaimer: I'm not a cryptographer).
  - kevdev 4y ago
    You’re correct.
  - upofadown 4y ago
    >I thought the point of forward secrecy in end-to-end encrypted messaging was to protect past conversations at the transport layer against the key being compromised? Yes. Exactly. Only the transport part is protected. Contrast, say, TLS with messaging. TLS is basically an encrypted pipe. Plaintext goes in and plaintext comes out. If someone saves some of that plaintext and it gets leaked, well, that isn't your job to prevent that but you can at least provide forward secrecy. After all, people don't normally save their sensitive web pages for extended periods of time... With messaging, saving old messages is more or less the default. When that happens the value of forward secrecy is negated. If you want your old messages to be gone, you (and your correspondent) actually have to get rid of them. >...man-in-the-middle attacker... Terminology quibble. I think this would be normally described as recording the encrypted messages off the wire. MITM implies than an attacker is impersonating one or more correspondents.
    - 4y ago

You use hardware keys and don’t care about forward secrecy. Private key never leaks. For offline file encryption ( pgp isn’t intended for messaging).

hiq 4y ago
> You use hardware keys and don’t care about forward secrecy. Private key never leaks. I guess you mean "leak" as in "being copied", which relies on how good the hardware actually is at preventing this, but what if I just lose my hardware key, isn't that the same?

upofadown 4y ago

Forward secrecy is somewhat overrated in end to end encrypted messaging. Most people do not want a truly off the record experience but instead keep their old messages around indefinitely. As long as those old messages exist and are accessible to the user they will be just as accessible to any attacker that gets access to the secret key material. The Signal Protocol somewhat excessively provides forward secrecy for each and every message sent. That is sort of pointless while the messages still exist on the screen. Most people would be happy getting rid of their old messages every week or so. You could totally do that in an instant messaging system that used OpenPGP formatted messages. The reason that no one bothers is because few people want to dump their old encrypted emails. No one wants to dump their old encrypted files. Instead they take advantage of the greater security inherent in an offline encryption system and avoid getting their keys leaked in the first place. If you really wanted to do message by message forward secrecy using a hash ratchet using OpenPGP formatted messages you could do that too. There is nothing magical about the Signal Protocol for stuff like that... Relevant discussion: * https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy

RunSet 4y ago
> The Signal Protocol somewhat excessively provides forward secrecy for each and every message sent. That is sort of pointless while the messages still exist on the screen. Or if the message's recipient took a screenshot.
wizeman 4y ago
I thought the point of forward secrecy in end-to-end encrypted messaging was to protect past conversations at the transport layer against the key being compromised? In other words, the point being that a man-in-the-middle attacker cannot decrypt past conversations that he recorded even if in the future he is able to determine the key? It's kind of obvious that you cannot prevent the other party from saving the messages, but from what I understand I don't think that's what forward secrecy is even trying to do (disclaimer: I'm not a cryptographer).
- kevdev 4y ago
  You’re correct.
- upofadown 4y ago
  >I thought the point of forward secrecy in end-to-end encrypted messaging was to protect past conversations at the transport layer against the key being compromised? Yes. Exactly. Only the transport part is protected. Contrast, say, TLS with messaging. TLS is basically an encrypted pipe. Plaintext goes in and plaintext comes out. If someone saves some of that plaintext and it gets leaked, well, that isn't your job to prevent that but you can at least provide forward secrecy. After all, people don't normally save their sensitive web pages for extended periods of time... With messaging, saving old messages is more or less the default. When that happens the value of forward secrecy is negated. If you want your old messages to be gone, you (and your correspondent) actually have to get rid of them. >...man-in-the-middle attacker... Terminology quibble. I think this would be normally described as recording the encrypted messages off the wire. MITM implies than an attacker is impersonating one or more correspondents.
  - 4y ago