3 ms·
Deniability is a useful characteristic in cryptographic protocols: the idea is the authenticity of the message can be proved to anyone who checks before the key
by rcxdude 3y ago
Deniability is a useful characteristic in cryptographic protocols: the idea is the authenticity of the message can be proved to anyone who checks before the key is published (i.e. likely the intended recipient of the message), but not to someone who checks later (i.e. likely someone who may wish to use the contents of the message against you). It's something Signal's chat protocol aims to achieve, for example.
- layer8 3y agoThis is builtin with X.509 certificates having an expiration date, and also the ability to revoke them before expiration. Unless you have a cryptographic timestamp proving the signature was made before expiration or revocation, signatures stop proving authenticity once the certificate has expired/been revoked.
- rcxdude 3y agoNo, because people don't think like SSL libraries and there's a big difference between "you should trust this key" and "this key provides good enough evidence of authenticity to count as incriminating". To defeat the latter the key must be published.
- layer8 3y agoYeah, that simply won’t happen with keys in HSMs, where private keys reside more and more frequently nowadays, as they should for security reasons. They are specifically designed to make it impossible for the key to leak. In Europe for example, this is a prerequisite for signatures with legal value.
- rcxdude 3y agoWhich is fine if you don't want deniability, and probably desirable for legal signatures. But that doesn't make it something with no value. Parent poster was claiming it made no sense to want authenticity and then publish the keys. I'm just pointing out that there is a desirable property which uses that approach. And HSMs can be (and commonly are) configured to store keys which can leave the device, though setting a specific time lock is not something I think many support.