4 ms·

The attacker could send different Ks to each user so that K decrypts C to a different plaintext.

sillysaurus3 12y ago
If you try to decrypt C with any key other than the K that was used to encrypt it, you'll get gibberish (the decryption process will fail). As far as I know, it isn't possible for an attacker to generate a message ciphertext C such that two different decryption keys would both decrypt to valid plaintexts. There can only be one valid decryption key; trying to decrypt C using any other key would yield random output, wouldn't it?
- kaeporan 12y ago
  I hope I'm not mistaken, but my understanding is that you can have the same message C that would decrypt with K1 to the plaintext "Hello world" but with K2 to another plaintext of your choice ("Jello Warld" or whatever.)
  - KMag 12y ago
    This is only true for one-time-pad encryption. For a given AES-256 cipher mode and ciphertext C, there are at most 2 * * 256 possible decryptions of C. For most pairs of ciphertext and plaintext (C, M2) longer than 32 bytes, there doesn't exist a key K2 that decrypts C to M2. Even if K2 exists, finding K2 given (C, M2) with an average work factor less than 2 255 implies you've found a weakness in AES-256.
tptacek 12y ago
Hence the continuous transcript consistency feature of the TextSecure protocol. Meanwhile: I'm curious about your answer to the question 'sdevlin posted downthread: https://news.ycombinator.com/item?id=7701510 https://news.ycombinator.com/item?id=7701510 Does your transcript consistency rely on the security of your server?
- kaeporan 12y ago
  Sorry, Thomas, but after you repeatedly replied to my private requests for conflict resolution with threats and abusive remarks, I refuse to interact with you entirely, publicly or privately. Those curious as to why I'm saying this should read Ptacek's other comments on this thread for a primer. Zed Shaw was right: http://zedshaw.com/essays/thomas_ptacek_should_apologize.html http://zedshaw.com/essays/thomas_ptacek_should_apologize.htm...
  - sillysaurus3 12y ago
    Instead of writing your comments for Thomas, why not write them for the HN community? We're all very interested in hearing your thoughts. Thomas poses some good questions; why not consider answering them for us?
    - deleted 12y ago
      [deleted]
    - kaeporan 12y ago
      I'll make sure to answer any other comments so long as I have something to contribute.
  - tptacek 12y ago
    That's funny. I agree that Zed Shaw was right: I thought that the context of the barb I directed at him in a talk many years ago --- where I compared him with Daniel Bernstein, Theo de Raadt, and Jason Fried from 37signals --- put him in an appreciative and positive light. But he didn't think so --- I hyperbolically said "Zed Shaw will kill your company" (the same way Theo and Bernstein would), and on review, I agreed that it was crazy that I thought the slide I had with him on it would seem benign to everyone. I agreed so much so that when I was invited to speak at CUSEC shortly thereafter, I was videotaped on stage opening my talk apologizing to him. Zed didn't update his post on his site to account for that, although he was aware both of my plan to apologize (we spoke on the phone and I agreed the apology was warranted, though not without some debate), and of the fact that I apologized (I confirmed it for him afterwards). But Zed doesn't owe me an update to his page, and I didn't ask for one. You, on the other hand, do bear an obligation to know what you're talking about before you try to use this incident in a public discussion. You obviously haven't lived up to that obligation. I owe you no apology. My opinion about you isn't concealed and you aren't misunderstanding me. However, you are misrepresenting my comments by referring to them as "abusive" and threatening. Unless you're threatened by criticism of your rhetoric and of the technical quality of your project.

If you try to decrypt C with any key other than the K that was used to encrypt it, you'll get gibberish (the decryption process will fail). As far as I know, it isn't possible for an attacker to generate a message ciphertext C such that two different decryption keys would both decrypt to valid plaintexts. There can only be one valid decryption key; trying to decrypt C using any other key would yield random output, wouldn't it?

kaeporan 12y ago
I hope I'm not mistaken, but my understanding is that you can have the same message C that would decrypt with K1 to the plaintext "Hello world" but with K2 to another plaintext of your choice ("Jello Warld" or whatever.)
- KMag 12y ago
  This is only true for one-time-pad encryption. For a given AES-256 cipher mode and ciphertext C, there are at most 2 * * 256 possible decryptions of C. For most pairs of ciphertext and plaintext (C, M2) longer than 32 bytes, there doesn't exist a key K2 that decrypts C to M2. Even if K2 exists, finding K2 given (C, M2) with an average work factor less than 2 255 implies you've found a weakness in AES-256.

tptacek 12y ago

Hence the continuous transcript consistency feature of the TextSecure protocol. Meanwhile: I'm curious about your answer to the question 'sdevlin posted downthread: https://news.ycombinator.com/item?id=7701510 https://news.ycombinator.com/item?id=7701510 Does your transcript consistency rely on the security of your server?

kaeporan 12y ago
Sorry, Thomas, but after you repeatedly replied to my private requests for conflict resolution with threats and abusive remarks, I refuse to interact with you entirely, publicly or privately. Those curious as to why I'm saying this should read Ptacek's other comments on this thread for a primer. Zed Shaw was right: http://zedshaw.com/essays/thomas_ptacek_should_apologize.html http://zedshaw.com/essays/thomas_ptacek_should_apologize.htm...
- sillysaurus3 12y ago
  Instead of writing your comments for Thomas, why not write them for the HN community? We're all very interested in hearing your thoughts. Thomas poses some good questions; why not consider answering them for us?
  - deleted 12y ago
    [deleted]
  - kaeporan 12y ago
    I'll make sure to answer any other comments so long as I have something to contribute.
- tptacek 12y ago
  That's funny. I agree that Zed Shaw was right: I thought that the context of the barb I directed at him in a talk many years ago --- where I compared him with Daniel Bernstein, Theo de Raadt, and Jason Fried from 37signals --- put him in an appreciative and positive light. But he didn't think so --- I hyperbolically said "Zed Shaw will kill your company" (the same way Theo and Bernstein would), and on review, I agreed that it was crazy that I thought the slide I had with him on it would seem benign to everyone. I agreed so much so that when I was invited to speak at CUSEC shortly thereafter, I was videotaped on stage opening my talk apologizing to him. Zed didn't update his post on his site to account for that, although he was aware both of my plan to apologize (we spoke on the phone and I agreed the apology was warranted, though not without some debate), and of the fact that I apologized (I confirmed it for him afterwards). But Zed doesn't owe me an update to his page, and I didn't ask for one. You, on the other hand, do bear an obligation to know what you're talking about before you try to use this incident in a public discussion. You obviously haven't lived up to that obligation. I owe you no apology. My opinion about you isn't concealed and you aren't misunderstanding me. However, you are misrepresenting my comments by referring to them as "abusive" and threatening. Unless you're threatened by criticism of your rhetoric and of the technical quality of your project.