4 ms·
Is this not susceptible to a man in the middle attack? You have to trust that WhisperSystems will never release the keys, and always maintain server security.
by 7952 13y ago
Is this not susceptible to a man in the middle attack? You have to trust that WhisperSystems will never release the keys, and always maintain server security. Perhaps it would be better to send the initial keys out of band.
- moxie 13y agoThe prekey messages are signed with the owner's identity key.
- sehrope 13y agoAre the prekeys generated/saved per potential contact (signed/encrypted with the contact's public key of course!) or is it a general pool for everybody? If it's the latter than couldn't a malicious user flood you with 100+ messages and prevent others from async contacting you?
- 7952 13y agoI think it uses SMS to send the actual messages. Anyway, the re-usability of keys is actually a feature that enables perfect forward secrecy.
- pampa 13y agoIf I get the idea right, the server keeps a list of Alice's p, g and A generated in advance for a Diffie-Hellman exchange. Bob then can complete his part of the key agreement when Alice is offline and send B together with the message ciphertext. It is vulnurable to a mitm attack just like online DH, but leaking the prekeys will not compromise anything, because the are designed to be public.
- 7952 13y agoThanks. I guess that one side of the communication is always assured to be authentic and not a MITM as it is not using a pre-generated key. Reading the documentation there is a facility to verify keys [1] with QR codes or voice over the phone. That's really cool. [1] https://github.com/WhisperSystems/TextSecure/wiki/Using-TextSecure https://github.com/WhisperSystems/TextSecure/wiki/Using-Text...
- StavrosK 13y agoThis does mean that you can't use ZRTP-style short authentication strings, though, as the attacker would have a very easy time brute-forcing the SAS. You'd have to verify the entire length of the fingerprint.