Den 17 apr 2015 11:55 skrev "Michael Rogers" <<a href="mailto:michael@briarproject.org">michael@briarproject.org</a>>: > > Hi all, > > I have a crypto problem that you might find interesting. The setting is > a private group discussion. The membership of the group is fixed and > known to all members. Each member knows a long-term public signature key > for each other member. These public signature keys may also be known to > people outside the group. > > Members should be able to send messages to the group, such that any > member of the group can verify that a message was written by the owner > of a particular signature key, but can't prove it to anyone outside the > group. This made me think of textsecure's axolotl, and they do their group messaging encryption pairwise among the members as well. Except they start off with triple DH to establish the chat session keys and they use ratcheting for the encryption and authentication keys. The design is meant to enable asynchronous deniable authenticated chats, i.e. it isn't necessary to be online simultaneously to preserve the security. Just decrypt the messages when you get them, ratchet the keys to get the keys to be used for the next message and then delete the old keys. They also use triple DH to be able to deny the fact that a real chat happened, as you can't distinguish a ciphertext log of a real chat from a faked one, unlike with standard OTR. Even if your keys later are leaked, only you (and the other party of the chat, if course) knows which chats are real on the basis of being the only one *who knows the origin* of the keys. You know they came from the authenticated key exchange. Nobody else can be certain, because all the nonces and session keys are long gone.