# Tag Info

3

There is already good scheme for this, Elliptic Curve Integrated Encryption Scheme (ECIES); Once you exchanged the keys with ECDH, then you can use a KDF to derive any key length, HKDF is fine. ECIES also authenticates the ciphertext as Encrypted-then-MAC. In order to use MAC, you need another key. You can use HKDF to derive many keys by providing different ...

2

There's nothing that you can do from a purely passive point of view. The private information relating to the certificate does not directly provide any information about the ephemeral keys used in the ECDHE exchange. This is part of the promise of forward security that ephemeral schemes provide. You can actively set up a man-in-the-middle gateway that ...

2

If something in the Signal protocol looks surprising, then the reason it's there is probably related to key compromise. The main thing to keep in mind is the fact that the "identity keys" are long-term secrets. Suppose Alice has long term key $a^*$ and Bob has long-term key $b^*$, with corresponding public keys $g^{a^*}$ and $g^{b^*}$. They can do ...

1

Alice - knowing $K_A$ - sends $K_A(B, R_A, t, P)$ to $BB$. $BB$ - knowing $K_A$ - decrypts $K_A(B, R_A, t, P)$, obtaining $(B, R_A, t, P)$. $BB$ - knowing $K_B$ and $K_{BB}$ - sends $K_B(A, R_A, t, P, K_{BB}(A, t, P))$ to Bob. Bob - knowing $K_B$ - decrypts $K_B(A, R_A, t, P, K_{BB}(A, t, P))$, obtaining $(A, R_A, t, P, K_{BB}(A, t, P))$. At this point you ...

1

If I understand it right, you want a way to prove, given a list $\{A, B, C, D, \cdots\}$ of public keys, that some given key $K$ is "the tag" corresponding to a pair of key from this list, without revealing which one. Let me call this a "valid tag". For simplicity, suppose that $K$ is the tag of Alice and Bob. Either Alice or Bob can ...

Only top voted, non community-wiki answers of a minimum length are eligible