Re:DecryptoCat
by tptacek on Thursday July 04, 2013 @11:39AM
(#5991113)
It's hard to think of a well-regarded widely-used multiparty encryption system, which is a good reason generalists shouldn't try to implement them.
[ Parent
| on HN ]
It's fairly straightforward (conceptually, if not in actual implementation) for a system without PFS, since you can reduce the problem to N interoperating conventional public key systems (e.g. how PGP works for multiple recipients). (and, obviously, just use OpenPGP for it...). But PFS is probably highly desirable in the "Syrian protest" scenario.
Or with a trusted third party (at the limit, just do irc-over-SSL.) This is probably fairly safe if you pick your TTP correctly -- I'd trust the NYT or USG even if I were a Syrian protester with the FSA.
I agree overall -- and am not trying to defend CryptoCat, just the CryptoCat market niche.