4 ms·

>Crucially, it's run by a nonprofit organisation... Sure, but for all we know it is a wholly owned subsidiary of the CIA. See Crypto AG[1]. >...if we all star

>Crucially, it's run by a nonprofit organisation... Sure, but for all we know it is a wholly owned subsidiary of the CIA. See Crypto AG[1]. >...if we all start to do this, it will mean more people are on Signal, hopefully gradually making it more attractive to move across! Signal is controlled by a single entity and is not federated. So it is only a matter of time before things fall apart. So it is not a good idea to promote it as some sort of messaging standard. I mean, Signal is OK and is a fine replacement for Whatsapp, but all these rabid expressions of Signal fandom are starting to get annoying. [1] https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG

maqp 1y ago
>Sure, but for all we know it is a wholly owned subsidiary of the CIA. See Crypto AG[1]. This is such a sad propaganda tactic. Signal's client is 100% open source. The Android client has reproducible builds. You can verify yourself the cryptographic primitives are used, and function correctly with test vectors. E.g. Here's those for the key exchange X25519 https://datatracker.ietf.org/doc/html/rfc7748 https://datatracker.ietf.org/doc/html/rfc7748 Here's the test vectors for AES https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/aes/AESAVS.pdf https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algo... >Signal is controlled by a single entity and is not federated. So it is only a matter of time before things fall apart. It's backed by the Signal foundation, donations, and it doesn't suffer from bike shedding bigger federated systems struggle with. Take OpenPGP v5 fingerprints that are still, 15 years after SHA-1 was considered weak, not available in gpg, if at all. Federated systems and standards bodies with disengaged management are easy to subvert from the inside with tactics like these https://www.404media.co/declassified-cia-guide-to-sabotaging-fascism-is-suddenly-viral/ https://www.404media.co/declassified-cia-guide-to-sabotaging... >So it is not a good idea to promote it as some sort of messaging standard. The protocol isn't a standard, but its security properties are the gold standard. That's why it's being used in most networked TCB apps that take their security as serious as they can. You're also not proposing a solution so I take it you're advocating for Matrix.
- upofadown 1y ago
  >Take OpenPGP v5 fingerprints that are still, 15 years after SHA-1 was considered weak, not available in gpg, if at all. Assuming you mean V5 PGP keys. There are 2 proposed key formats due to the standards fork which actually supports your argument. But since there is no actual weakness, it is safe to just stick with what people have been using since forever. SHA-1 is only broken for collisions. Fingerprints do not require collision resistance. PGP used to use only 32 bits of the SHA-1 hash for the short form of the fingerprint. That became problematic because they could be straight up forged from an existing fingerprint so now 64 bits are used. Such fingerprints are trivially collideable simply because of the length. But, again, that is not an issue. You have to look at the security of the system when evaluating things like this, not just looking for particular primitives. >You're also not proposing a solution so I take it you're advocating for Matrix. Yeah, fans tend to assume that everyone is a fan of something... Just saying...
  - maqp 1y ago
    >Fingerprints do not require collision resistance. That's what they're literally there for. To avoid situation where someone generates a key with matching fingerprint, and the person importing the key doesn't detect it's a forgery. >Yeah, fans tend to assume that everyone is a fan of something... Just saying... Yeah I'm a fan of adequate computational headroom where it doesn't cost anything.
    - upofadown 1y ago
      >To avoid situation where someone generates a key with matching fingerprint... That would be a preimage attack. No one knows how to do that with SHA-1. The best you could do would be to generate two different keypairs with the same fingerprint. That doesn't have any security implications. ... which is lucky, otherwise we would need unusably long fingerprints in the 256 bit range. Note that Signal effectively only has 100 bits per identity for the key fingerprint (they combine two identities to make the 60 decimal digit safety number). Using a birthday attack, generating a collision would only involve 2^50 operations, which is practically feasible.

maqp 1y ago

>Sure, but for all we know it is a wholly owned subsidiary of the CIA. See Crypto AG[1]. This is such a sad propaganda tactic. Signal's client is 100% open source. The Android client has reproducible builds. You can verify yourself the cryptographic primitives are used, and function correctly with test vectors. E.g. Here's those for the key exchange X25519 https://datatracker.ietf.org/doc/html/rfc7748 https://datatracker.ietf.org/doc/html/rfc7748 Here's the test vectors for AES https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/aes/AESAVS.pdf https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algo... >Signal is controlled by a single entity and is not federated. So it is only a matter of time before things fall apart. It's backed by the Signal foundation, donations, and it doesn't suffer from bike shedding bigger federated systems struggle with. Take OpenPGP v5 fingerprints that are still, 15 years after SHA-1 was considered weak, not available in gpg, if at all. Federated systems and standards bodies with disengaged management are easy to subvert from the inside with tactics like these https://www.404media.co/declassified-cia-guide-to-sabotaging-fascism-is-suddenly-viral/ https://www.404media.co/declassified-cia-guide-to-sabotaging... >So it is not a good idea to promote it as some sort of messaging standard. The protocol isn't a standard, but its security properties are the gold standard. That's why it's being used in most networked TCB apps that take their security as serious as they can. You're also not proposing a solution so I take it you're advocating for Matrix.

upofadown 1y ago
>Take OpenPGP v5 fingerprints that are still, 15 years after SHA-1 was considered weak, not available in gpg, if at all. Assuming you mean V5 PGP keys. There are 2 proposed key formats due to the standards fork which actually supports your argument. But since there is no actual weakness, it is safe to just stick with what people have been using since forever. SHA-1 is only broken for collisions. Fingerprints do not require collision resistance. PGP used to use only 32 bits of the SHA-1 hash for the short form of the fingerprint. That became problematic because they could be straight up forged from an existing fingerprint so now 64 bits are used. Such fingerprints are trivially collideable simply because of the length. But, again, that is not an issue. You have to look at the security of the system when evaluating things like this, not just looking for particular primitives. >You're also not proposing a solution so I take it you're advocating for Matrix. Yeah, fans tend to assume that everyone is a fan of something... Just saying...
- maqp 1y ago
  >Fingerprints do not require collision resistance. That's what they're literally there for. To avoid situation where someone generates a key with matching fingerprint, and the person importing the key doesn't detect it's a forgery. >Yeah, fans tend to assume that everyone is a fan of something... Just saying... Yeah I'm a fan of adequate computational headroom where it doesn't cost anything.
  - upofadown 1y ago
    >To avoid situation where someone generates a key with matching fingerprint... That would be a preimage attack. No one knows how to do that with SHA-1. The best you could do would be to generate two different keypairs with the same fingerprint. That doesn't have any security implications. ... which is lucky, otherwise we would need unusably long fingerprints in the 256 bit range. Note that Signal effectively only has 100 bits per identity for the key fingerprint (they combine two identities to make the 60 decimal digit safety number). Using a birthday attack, generating a collision would only involve 2^50 operations, which is practically feasible.