News for hackers. Stuff that matters.

A comment on An airdrop that preserves recipient privacy [pdf]. Parent comment

Re:An airdrop that preserves recipient privacy [pdf] by rvnx on Friday February 14, 2020 @04:33PM (#22330620)
No. It's not like that at all. Otherwise there would be no controversy.

The airdrop tool takes your private key and your passphrase, does some overcomplicated (and unconventional) magic with it and asks you to post the resulting data to the public.

[ Parent | on HN ]
Re:An airdrop that preserves recipient privacy [pdf] by pinhead26 on Friday February 14, 2020 @05:57PM (#22331282)
The Goosig (extra blinding crpyto) is also optional. With the --bare flag, its just a signature.
[ Parent | on HN ]
Re:An airdrop that preserves recipient privacy [pdf] by rvnx on Friday February 14, 2020 @06:25PM (#22331465)
Try it please :) I've spent several hours around this option.
[ Parent | on HN ]
Re:An airdrop that preserves recipient privacy [pdf] by rvnx on Friday February 14, 2020 @07:17PM (#22331835)
I've explained above why it cannot work, but I'm still digging on alternative that wouldn't consist on revealing the private key.
[ Parent | on HN ]
Re:An airdrop that preserves recipient privacy [pdf] by rvnx on Friday February 14, 2020 @10:47PM (#22333087)
More feedback, if I understood it right: if you extract the findNonces function, dump the 1500 files of 512 bytes, transfer them to a machine that has the ssh private key, then you should be able to sign without risking anything (encryption is RSA-OAEP), because your private key wouldn't touch the software.
[ Parent | on HN ]