just trying lemmy

  • 34 Posts
  • 153 Comments
Joined 2 года назад
cake
Cake day: 3 июня 2023 г.

help-circle











  • Honestly I’m not sure what the definition says. But in case of the original axolotl/signal protocol the ‘ratchet’ construction in my understanding allows to recover from a key compromise given that the attacker is passive (read only). Let’s say you have to hand your phone to the police, they disappear with it for a moment and get a copy of all the keys you use for the axolotl protocol. As long as they don’t manage to manipulate network traffic but only intercept everything your chat session will ‘recover’ once a new (EC)DH agreement is completed with your chat partner. This might not happen immediately though in case your chat partner is offline.

    This property (securing future messages) can only be achieved with asymmetric cryptography. Securing past messages can in principle be achieved with symmetric cryptography: You could imagine a ratchet mechanism where each chat partner computes a new key by transforming the old key with a entropy-preserving and hard-to-invert function (such as sha3) and then deleting the old key (and also best deleting old messages).

    P.S. Just did some reading: https://signal.org/docs/specifications/doubleratchet/

    Forward security: Output keys from the past appear random to an adversary who learns the KDF key at some point in time.
    
    Break-in recovery: Future output keys appear random to an adversary who learns the KDF key at some point in time, provided that future inputs have added sufficient entropy.
    

    So what I meant is not called forward secrecy but break-in recovery. Confusing terms.











  • There’s nothing stopping you from using GPL.

    But there is a culture - I think even explicit - of using MIT or APACHE licensing. In some sense is okay, because it simplifies crate compatibility. But it comes at the cost of feeding the usual suspects who now obviously turn against humanity.

    My unconfirmed suspicion is that there are forces behind (Google, Microsoft, Amazon, Meta) who like permissive licenses because this makes it easier for them to exploit the work of the public.