Hacker News Reader

That's the reason that the hash ratchet has never seemed all that valuable to me. I mean, yeah, it is kind of cool that each and every message is in a sense forward secret, but as you point out it isn't a very good form of forward secrecy. Most would be happy with dumping the keys after a chat session or when it actually matters, when the corresponding archived messages are deleted.

View on HN

It is a fine form of forward secrecy: past messages aren't compromised by later keys being compromised. The sender/receiver ratchets essentially provide a notion of what a session means in an asynchronous environment, and the double ratchet algorithm shrinks the window as much as is possible i.e. every time the sender/receiver changes. Dumping the keys only when messages are deleted is an extremely poor security practice.

Dumping the keys before the messages are deleted is kind of pointless. An attacker that gets some form of access to the private key material is going to also have access to any archived messages in any sort of instant messaging environment. You can't make old messages go away simply by forgetting the session key used to transmit them if you keep them around in some other form.

Reply on news.ycombinator.com