I asked a question yesterday about the Keybase key model and got no answers, unfortunately. Let me rephrase the question to make it clearer: in the case, if 2 users just want to send each other low-frequency e2e encrypted messages (e.g. files) via a 3rd party semi-trusted server over a secure channel i.e. TLS, using curve25519 key pairs and do x25519 and AEAD(e.g. poly1305chacha20 like in libsodium's crypto_box_*()). Note that this is not a public web server or a VPN where messages have a streaming nature and you can have thousands if not millions of ciphertexts messages in a short period of time.

  • Is being concerned about forward-secrecy in such case irrelevant and somewhat overkill and static-static DH is enough?

  • Also, can ephemeral-static DH mitigate the forward-secrecy problem, at least for one party (aka the receiver) since static-static DH still suffers that if one of the parties got compromised all the messages are then compromised regardless of whether the other party is keeping his private key secure?

  • $\begingroup$ A related question Is forward secrecy overhyped or necessary? and the answer contains some of your concerns. $\endgroup$
    – kelalaka
    Dec 19, 2019 at 23:08
  • $\begingroup$ Seems to me that if you use ECIES (as used for the crypto-box, if I'm not mistaken) then you're already performing ephemeral DH to a large degree. What other cryptosystem were you thinking of that doesn't use an ephemeral key pair? $\endgroup$
    – Maarten Bodewes
    Dec 20, 2019 at 1:12
  • $\begingroup$ thanks @Maarten-reinstateMonica ! but how? aren't the same 2 key pairs argument of x25519 keys going to produce the same resultant key that is going to be used in the symmetric AEAD with polychacha? assuming we're talking about the case of libsodium/nacl $\endgroup$ Dec 20, 2019 at 1:23
  • 1
    $\begingroup$ Let me check. I guess the answer to the question depends on the use case. You need static key pairs anyway if you require authentication of both parties. So what's more important: securing the ciphertext or securing the authenticity of the party that send it? $\endgroup$
    – Maarten Bodewes
    Dec 20, 2019 at 1:26
  • $\begingroup$ I believe that "securing the authenticity of the party that send it" is much more important. But why do I have to choose? $\endgroup$ Dec 20, 2019 at 1:28


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.