<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hey guys!</div><div class=""><br class=""></div><div class="">Cruising around Axolotl spec recently, i’ve just stumbled upon one grit constantly disturbing me:</div><div class=""><br class=""></div><div class=""><a href="https://whispersystems.org/blog/simplifying-otr-deniability/" class="">https://whispersystems.org/blog/simplifying-otr-deniability/</a></div><div class=""><br class=""></div><div class="">Chapter dubbed “Potential Simplifications and Improvements” lists all the gains of replacement of OTR’s original handshake involving DSA, with </div><div class="">“Triple DH” involving just both sides’ identity keys (A and B) and ephemeral keypairs (a and b).</div><div class=""><br class=""></div><div class="">What confusing me is two following statements:</div><div class=""><blockquote type="cite" class=""><ol style="font-family: Nobile; font-size: 16px; line-height: 24px;" class=""><li class=""><strong class="">Reduced Algorithmic Complexity</strong>. We’ve eliminated DSA and have a nice <i class=""><font color="#ff2600" class="">authenticated</font></i> key exchange that relies solely on the simplicity of Diffie-Hellman.</li><li class=""><strong class="">Increased Forgability</strong>. Since there are no signatures involved, anyone could take A’s public key, make up an ephemeral keypair for A (“a” in the diagram above), combine that with their own identity key and ephemeral key (“C” and “c”), and produce an entire forged transcript – <em class="">even if they’ve never had a conversation with “A” before</em>. Now anyone is capable of easily producing a forged message from anyone else, whether they’ve actually had a conversation with them before or not.</li></ol></blockquote><div class="">Those two seems kinda mutually exclusive: if we do actually have an <i class="">authenticated </i>key exchange, then we’ re losing so promising statement of deniability, since any one could <i class="">authenticate </i>us during the handshake.</div></div><div class="">The other way around, lacking authenticity, we’re making ourselves prone to MITM unless there is an established channel to verify public keys.</div><div class=""><br class=""></div><div class="">Have i missed something?</div><br class=""><div class="">
Best regards,<br class="">Alexey Kudinkin
</div>
<br class=""></body></html>