The X3DH Key Agreement Protocol
whispersystems.org
The X3DH Key Agreement Protocol
1–10 of 13 posts
Re: The X3DH Key Agreement Protocol
#2What's the point of a secure cryptographic protocol if your messaging app
a.) Sends back telemetry data
b.) Accepts arbitrary software updates without user approval
c.) Contains proprietary components with unknown workings
and d.) Forces you to send all of your messages over hostile servers?
Re: The X3DH Key Agreement Protocol
#3What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?
I can reply for d): end-to-end encryption.
Re: The X3DH Key Agreement Protocol
#4What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?
I can reply for d): end-to-end encryption.
That's pretty much the reply for all of them. Except c) but I thought the protocol itself was open if not the server end.
Re: The X3DH Key Agreement Protocol
#5What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?
Elaborate on a) ?
That's indeed very troubling and completely unacceptable if it's true.
Re: The X3DH Key Agreement Protocol
#6What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?
That document is placed in the public domain. If you hate Signal that much, write another one yourself.
Re: The X3DH Key Agreement Protocol
#7What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?
Funny how you created a throwaway account just for trolling
Re: The X3DH Key Agreement Protocol
#8What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?
Elaborate on a) ? That's indeed very troubling and completely unacceptable if it's true.
[deleted]
Re: The X3DH Key Agreement Protocol
#9What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?
On (a)
This https://whispersystems.org/bigbrother/eastern-virginia-grand..., claims they only store "date and time a user registered with Signal and the last date of a user's connectivity to the Signal service".
However I think the parent might be concerned that OWS could be compelled to change their server code to log more meta data, currently we must trust them.
For (b) Not sure what could be done about this, maybe an independent service audits each release, subsequent audits would take less time since the diff of the code base would be small. Don't really know, I'd like to know of there are any solutions to this, it seems less like a technical problem than the others though.
For (c) Opening up the server code would encourage people to run their own, see See https://whispersystems.org/blog/the-ecosystem-is-moving/ for why moxie doesn't want federation.
On (d) Using GCM means Google can get all the meta data too if they want/are compelled to. This is a legitimate concern but OWS is very clear what signal does, they don't claim to tackle e.g. traffic analysis. A world with everyone using end to end encryption would be much closed to the crypto-utopia.
Re: The X3DH Key Agreement Protocol
#10It would be interesting to know how this relates to Axolotl and "the Signal protocol".