3 ms·
Can you have true E2E encryption without knowing your peer's public key in advance? They could cheat by sending you to talk to someone else in a "private" manne
by dietr1ch 2y ago
Can you have true E2E encryption without knowing your peer's public key in advance?
They could cheat by sending you to talk to someone else in a "private" manner.
An offline attack against the host's keys that relies on undisclosed vulnerabilities, or an online one against their infra that abuses recent CVEs and bad security also seem possible.
- Manuel_D 2y agoWouldn't this involve breaking the trust chain? You can't just redirect HTTPS traffic to a separate host with a different key. If the government demanded the peer's private key then this is possible. But you can't just arbitrarily redirect traffic without resulting in a cert error.
- eddd-ddde 2y agoYou don't even have to ask the peer. Because of the same chain of trust, you can just ask the root authority to give you a certificate for peer's identity.