Re:Tox Handshake Vulnerable to KCI
by lvh on Friday January 13, 2017 @03:20PM
(#13394353)
I'm writing this up, and then I realized I asked Jason to put an example in his opening post, and I'm not sure I can do much better. In the original issue description, there's an interaction where Mallory successfully dupes Alice. Is there a specific step you feel doesn't work?
[ Parent
| on HN ]
Re:Tox Handshake Vulnerable to KCI
by grayhatter on Friday January 13, 2017 @04:25PM
(#13394822)
Sorry, I must have spaced out half way through writing that reply. I originally intended to write something along the lines of, "How is the attack solved by your example." I'm trying to wrap my head around the fix for this attack without key signing. (Short of reading the source for noise)
Which example are you referring to? The HN comment with the AKE?
Re:Tox Handshake Vulnerable to KCI
by grayhatter on Friday January 13, 2017 @08:17PM
(#13396244)
Your top comment on HN.
What's part am I missing that if we used hash(long_key pair + emp_key pair) protects us if the long term is known by an attacker? Why couldn't the attacker intercept the emp_keys.
I'm assuming there's no key signing done here.