141 reputation
3
bio website
location
age
visits member for 1 year, 7 months
seen Jan 17 '13 at 23:39

Jul
14
awarded  Student
Jan
23
awarded  Teacher
Jan
17
comment Cryptographic Protocol using NaCl
Yes, S' is reused between clients. But the incrementing counters used as part of the crypto_box nonce should prevent any replays of messages between short-term (ST) keys. Replaying (3) to the client is ignored, as after that is sent, they expect only S' to be used by the server. Replaying (2) to the server allows you to get as many encrypted S' as you like, which therefore tells you S'public without having to generate your own C'. Which is a small saving, but not much. Am I missing something?
Jan
17
revised Cryptographic Protocol using NaCl
mention when client short-term keys are created/destroyed.
Jan
17
comment Cryptographic Protocol using NaCl
I was talking about the nonce, N, in that case. If the server is re-using short-term keys, that would blow the whole system open, assuming you had the same client keys connected, because then you would also probably get crypto_box nonce reuse with the same keypair, and at that point, you can just XOR the two packets. The keys shouldn't repeat naturally by chance, though. However, I should make the start of the protocol more specific either way.
Jan
17
revised Cryptographic Protocol using NaCl
tiny notation fix
Jan
17
comment Cryptographic Protocol using NaCl
Also, after some more thought, I'm fairly certain now that actually the Nonce pass back and forth at the start of the conversation does nothing. The security of that comes from the fact that without the server's private key, it should be unfeasible to forge a packet encrypted between the server's long term and the client's short term key. So my question mostly boils down to "Can you be sure of the authenticity of a key wrapped in a crypto_box?", to which the answer should be "Yes", since crypto_boxes are authenticated.
Jan
17
awarded  Editor
Jan
17
comment Cryptographic Protocol using NaCl
That was a very good point. I've updated the question to reflect the CurveCP notation. That was just a more or less direct transcription from the notepad where I'd been puzzling this out.
Jan
17
revised Cryptographic Protocol using NaCl
Revised notation.
Jan
16
answered Streaming API to authenticated encryption
Jan
16
asked Cryptographic Protocol using NaCl