- cross-posted to:
- fediverse@lemmy.world
- cross-posted to:
- fediverse@lemmy.world
You must log in or register to comment.
Finally, someone is treating federation like it deserves real security instead of hoping nobody looks too closely. Key transparency feels like the only approach that scales without making normal users compare fingerprints. Now comes the fun part: convincing every ActivityPub client to implement it the same way.
How do your users know which Public Key belongs to someone they want to communicate with?
Put it in their profile. Seriously that’s it. You can use a profile metadata field if you want to be formal about it.
Why would you need a history of what keys were whose?
Your instance admin subtitutes the public key in your profile with one they control.
How do you stop this?
Like, half the point of E2EE for DMs is to prevent instance admins from seeing what your messages say. The other half is to prevent instance admins from being able to surrender anything useful to government subpoenas.
As long as the admin doesn’t possess the private key, that solution still prevents the latter issue. If the admin swaps out your public key for one they control, they could technically impersonate you and read messages after the swap, but not read any messages from before. The user would be unable to use E2EE as soon as the key is swapped, so the only real issue here is impersonation.
An admin could theoretically take over a user’s account today, so there’s not really a new vulnerability here. And with E2EE, there’d be a big clue about something funky happening with the public key changing.
EDIT: Oh.
These aren’t encapsulation keys (a.k.a., asymmetric or “public key encryption” keys). Encapsulation keys belong to the MLS KeyPackages, which are NOT planned to ever be logged in a key transparency system. The KeyPackages will be signed by the keypair whose public component is stored, however.
That seems… strange? Not sure why that approach was chosen.
The user would be unable to use E2EE as soon as the key is swapped, so the only real issue here is impersonation.
If an admin mitms all the messages then they can re-encrypt using the users original/real public key, leaving the user unaware that they have been hacked and able to use encryption as normal, or am I missing something?
How much do you know about cryptography?
I’ve written tons about why this approach was taken, but it might be inaccessible to someone with limited knowledge of modern cryptography protocol design. (Authenticated encryption, forward secrecy, context commitment, etc.)
This was my earliest blog post on the topic, if you want a place to start.
How much do you know about cryptography?
I’d describe myself as a relatively knowledgeable layman. Essentially I know enough to use it effectively in a sysadmin/dbadmin capacity, but not got a good grasp of the underlying math.
This was my earliest blog post on the topic, if you want a place to start.
Thank you, I’ll take you up on that.
The biggest unsolved problem in public key cryptography is knowing that a public key belongs to a particular individual. Making sure an attacker hasn’t swapped out keys or is impersonating you is a problem.with a non trivial solution
