<div dir="ltr"><div><div>Just to beat this dead horse one more time before I shut up. :-) </div>I wrote a test to investigate the impact of null keys (ephemeral or static) on the chaining key. For this purpose I classify "entropy collapse" as a scenario where all DH outputs are the null value, making the chaining key completely deterministic even if some of the inputs were non-null. </div>I found about 40 scenarios in the existing handshake patterns where entropy collapse can occur, listed at the end of this message. An example: <div><div> Noise_XK(s, rs): e s </div><div>In this case, if "e" and "s" are both null, then all DH outputs will be null even if "re" and "rs" were non-null. Some of the scenarios require mutual collaboration (e.g. "e re") but quite a lot occur when only one side is outputting nulls. No matter what the other side does, it doesn't help get back to an unpredictable chaining key. </div><div>If null ephemeral keys are banned, then the list reduces to only 3 scenarios, all one-way patterns. </div><div> Cheers, Rhys. Scenarios where entropy collapse occurs if null ephemeral keys are banned: Noise_N(rs): rs Noise_X(s, rs): rs Noise_K(s, rs): rs Scenarios where entropy collapse can occur due to null keys: Noise_N(rs): e Noise_N(rs): rs Noise_X(s, rs): e s Noise_X(s, rs): rs Noise_K(s, rs): e s Noise_K(s, rs): rs Noise_NN(): e Noise_NN(): re Noise_NK(rs): e Noise_NK(rs): re rs Noise_NX(rs): e Noise_NX(rs): re rs Noise_XN(s): e s Noise_XN(s): re Noise_XK(s, rs): e s Noise_XK(s, rs): e re Noise_XK(s, rs): re rs Noise_XX(s, rs): e s Noise_XX(s, rs): e re Noise_XX(s, rs): re rs Noise_XR(s, rs): e s Noise_XR(s, rs): e re Noise_XR(s, rs): re rs Noise_KN(s): e s Noise_KN(s): re Noise_KK(s, rs): e s Noise_KK(s, rs): re rs Noise_KX(s, rs): e s Noise_KX(s, rs): e re Noise_KX(s, rs): re rs Noise_IN(s): e s Noise_IN(s): re Noise_IK(s, rs): e s Noise_IK(s, rs): re rs Noise_IX(s, rs): e s Noise_IX(s, rs): e re Noise_IX(s, rs): re rs Noise_XXfallback(s, rs, re): e s Noise_XXfallback(s, rs, re): e re Noise_XXfallback(s, rs, re): re rs </div></div></div>