New answers tagged

0

In fact $DH1, DH2$ and $DH3$ are not "announced through untrusted channels". I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself. To be more concrete, if IK_A = g^{sk_A}, and SPK_B=g^{sk_B}, with $sk_A$ a secrete value already known by Alice. Then she could compute DH(...


0

That much risk is acceptable in Signal protocol as it only affects small number of messages of the sending chain. As soon as Alice replies, the ratchet starts new sending chain and the keys in compromised chain can be no longer used to compromise new messages. Ratchet has the nice property of being “self healing.” If, for whatever reason, any individual ...


1

Bob will keep sending his public key. Since he only ratchets on receiving messages, his DH Rachet will never activate and there is now no forward secrecy for the N messages he sent? If there are indeed no answers over the ratcheted channel, this is correct. However, some implementations send their receive receipts via the ratcheted channel, meaning that the ...


Top 50 recent answers are included