4 ms·

Oh, you're right about it not being the default. I could've sworn it was the default way back when, but I might be misremembering. Also wasn't aware Signal rebr

Oh, you're right about it not being the default. I could've sworn it was the default way back when, but I might be misremembering. Also wasn't aware Signal rebranded. > “Innocent until proven guilty” is for criminal systems, not security analysis. Sorry if this sounds ignorant; I'm not a cryptanalyst/security researcher. Isn't this kind of the norm in the industry? A few examples come to mind like hashing algorithms or encryption methods becoming obsolete over the years. Was that due to the innocent-until-guilty mindset, or because computational power just overtook those standards?

lxgr 3y ago
> Isn't this kind of the norm in the industry? It's a bit of a mix of both! At the low level, we unfortunately can't do much more than hope that certain fundamental mathematical/computational complexity assumptions hold. For RSA, that's the assumption that factoring prime numbers is hard; for AES, it's the assumption that it's really hard to invert the pseudorandom permutation a given AES key and the algorithm description represents. We don't have formal proof for these assumptions (or really hopes) being true; some even suspect that these proofs are fundamentally impossible. In that sense, these really are assumed secure until proven otherwise (by counterexample). And one such counterexample to RSA, Diffie-Hellman and its elliptic curve variants are certain quantum computing algorithms! However, at the high level, there is the concept of security proofs. These are formal, and in a nutshell they (often) work by mapping a new/unknown problem or solution onto a known one we've already proven some property of. An example of that would be "if the decisional Diffie-Hellman assumption holds, running protocol x is a secure way of deriving a session key, and a passive observer can't derive the key themselves with non-negligible probability/without improbable resource expenditure" (obviously the actual formalism is much more involved). In that sense, at the high level, there are positive security proofs, and this is the kind of work that the researchers working on Signal do. It's much harder than clobbering together a few low-level cryptographic primitives and hoping that they'll stick securely, but it's the best approach we have!
- spoiler 3y ago
  Thanks for the thoughtful and detailed reply!

lxgr 3y ago

> Isn't this kind of the norm in the industry? It's a bit of a mix of both! At the low level, we unfortunately can't do much more than hope that certain fundamental mathematical/computational complexity assumptions hold. For RSA, that's the assumption that factoring prime numbers is hard; for AES, it's the assumption that it's really hard to invert the pseudorandom permutation a given AES key and the algorithm description represents. We don't have formal proof for these assumptions (or really hopes) being true; some even suspect that these proofs are fundamentally impossible. In that sense, these really are assumed secure until proven otherwise (by counterexample). And one such counterexample to RSA, Diffie-Hellman and its elliptic curve variants are certain quantum computing algorithms! However, at the high level, there is the concept of security proofs. These are formal, and in a nutshell they (often) work by mapping a new/unknown problem or solution onto a known one we've already proven some property of. An example of that would be "if the decisional Diffie-Hellman assumption holds, running protocol x is a secure way of deriving a session key, and a passive observer can't derive the key themselves with non-negligible probability/without improbable resource expenditure" (obviously the actual formalism is much more involved). In that sense, at the high level, there are positive security proofs, and this is the kind of work that the researchers working on Signal do. It's much harder than clobbering together a few low-level cryptographic primitives and hoping that they'll stick securely, but it's the best approach we have!

spoiler 3y ago
Thanks for the thoughtful and detailed reply!