Don't use Session – Round 2
soatok.blog
soatok.blog
It was after a year or so of usage that I realized that Wire does not provide any way to export or save chats outside of its application (it has a backup option to backup from and restore back to Wire). Wire also seems to store images on its servers and those images won’t be available if you save a backup and restore from it. The backup formats are platform/OS specific. Losing images but having just text alone was a big loss for me.
For all practical purposes from a basic end user’s point of view, Wire can be considered as proprietary and closed as Instagram or FB Messenger.
What I don't understand is why we have people who are so worried about forward secrecy, which protects you in relatively unusual circumstances, but not worried about traffic analysis, which is always a huge issue.
From my point of view, this guy (or anybody) loses a ton of credibility when he says you shouldn't use a decentralized protocol, even with poorly quantified (but nonzero) resistance against traffic analysis, because it lacks PFS... and then turns around and suggests instead using Signal, which has exactly zero resistance against traffic analysis. For most real use cases, the traffic analysis is a vastly more important concern. I tend to think this is an example of how cryptographers get themselves into trouble by worrying about relative arcana, while declaring major practical attacks "out of scope".
I could probably turn that into an NSA conspiracy theory at least as credible as the one in the blog post, although in fact I don't think there are any NSA conspiracies in play on any side here.
Sounds like the Session people should clean up their code and enlarge their random seeds, though.
The fact that this is a valid way to do a Pollard's rho:
public function iterate(string $publicKey): array
{
$sk = $this->uniformToBiased($publicKey);
$pk = sodium_crypto_scalarmult_ristretto255_base(
sodium_crypto_generichash($sk)
);
return [$sk, $pk];
}