4 ms·

I'm all for anything that makes moving one's private key between devices easier, and I understand that you've made a conscious compromise between security and u

by scoot 13y ago

I'm all for anything that makes moving one's private key between devices easier, and I understand that you've made a conscious compromise between security and usability, but wouldn't it be possible to achieve both goals, for example by enabling private key syncronisation between devices without the key having to be uploaded to a third-party server? This would also eliminate the need for the additional passphrase, as the point-to-point key trasfer could by programatically encrypted / decrypted without user intervention.

napoleond 13y ago
That's a great idea, and I see no reason that it couldn't be done. Removing the centralized target would obviously be beneficial, but I'm not sure it would be possible to increase security for individual users that much: If the only common information between the two devices is what's in the user's head (email, password) then you'd still need a server to negotiate the exchange (by telling the new device where to find the first one) which would leave the whole system vulnerable to many of the same targeted attacks as the centralized design (MITM or malicious actor at the server trying to brute force individual keys).
- scoot 13y ago
  I agree, but it should still be possible mitigate those sorts of threats without the user needing anything else in thier head (at least more than temporarily :-), even if the password for the negotiation was successfully brute-forced / MITM'd so that a foreign device could initiate a private key transfer, and even if the private key exchange itself was MITM'd. Perhaps for example using a one-time shared secret either displayed on one device and entered in the other, or entered by the user on both devices as a temporary pass-phrase. This could then form part of a D-H style key exchange, or even be the encryption passphrase as in your proposed model, but only used temporarily while the private key is transferred, so not having to be remembered by the user for a centrally stored copy of the private key. I appreciate you're probably well down the track on your current model, but it would be really nice to see something like this developed, and ultimately standardised, as like you mention in your manifesto, private key management (and especially transfer and backup) is one of the larger usability barriers to wider adoption of public-key cryptography.

by scoot 13y ago

napoleond 13y ago

That's a great idea, and I see no reason that it couldn't be done. Removing the centralized target would obviously be beneficial, but I'm not sure it would be possible to increase security for individual users that much: If the only common information between the two devices is what's in the user's head (email, password) then you'd still need a server to negotiate the exchange (by telling the new device where to find the first one) which would leave the whole system vulnerable to many of the same targeted attacks as the centralized design (MITM or malicious actor at the server trying to brute force individual keys).

scoot 13y ago
I agree, but it should still be possible mitigate those sorts of threats without the user needing anything else in thier head (at least more than temporarily :-), even if the password for the negotiation was successfully brute-forced / MITM'd so that a foreign device could initiate a private key transfer, and even if the private key exchange itself was MITM'd. Perhaps for example using a one-time shared secret either displayed on one device and entered in the other, or entered by the user on both devices as a temporary pass-phrase. This could then form part of a D-H style key exchange, or even be the encryption passphrase as in your proposed model, but only used temporarily while the private key is transferred, so not having to be remembered by the user for a centrally stored copy of the private key. I appreciate you're probably well down the track on your current model, but it would be really nice to see something like this developed, and ultimately standardised, as like you mention in your manifesto, private key management (and especially transfer and backup) is one of the larger usability barriers to wider adoption of public-key cryptography.