<div dir="ltr"><div>Pattern analysis for KKnoss, IKnoss, KKss, KXss, XKss and IKss has begun and should be completed within a few hours. </div><div> </div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Nadim Kobeissi<div>Symbolic Software • <a href="https://symbolic.software" target="_blank">https://symbolic.software</a></div><div>Sent from office</div></div></div></div> </div> <div class="gmail_quote"><div dir="ltr">On Wed, Aug 15, 2018 at 12:23 AM Justin Cormack <<a href="mailto:justin@specialbusservice.com">justin@specialbusservice.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 14 August 2018 at 16:56, Trevor Perrin <<a href="mailto:trevp@trevp.net" target="_blank">trevp@trevp.net</a>> wrote: > OK, so I think there's 2 questions you're answering with the "ss" > patterns below: > > * You're using the "late" choice for deferred patterns (which you've > done consistently), and leaving out the "early" option I mentioned. I > think I agree with this: If you've chosen to defer the more-important > authentication DHs (se and es), it seems you probably would want to > defer the less-important ss DH that is just supplying a bit more > forward-secrecy against an unusual attack. Also, this is fairly > simple, and doesn't preclude us adding the other patterns later, if we > think of a reason for them. > > * You're making KKss and IKss identical with existing KK and IK, > instead of putting the "ss" on the end. Not sure I agree here, seems > like it gains us more flexibility to have a different option, and > perhaps more consistency to have the "ss" modified patterns always > have "ss" at the end. Also, it seems possible you might prefer to > skip the early "ss" for denial-of-service or (in KK) identity-hiding > reasons. Ok, well that gives the "always put the ss at the end" rule, which is also pretty simple. There aren't any other possibilities with any of the non deferred patterns anyway, so ok with that choice. > Anyways, I think we're converging on something - if you have time it > would be great to start a spec and link from wiki, also so we can get > Nadim some tentative patterns to analyze. Will do, am away for a bit and not sure how much time I will have immediately but will see. For reference these are the patterns if Nadim has time to analyze... KKnoss: -> s <- s ... -> e, es <- e, ee, se IKnoss: <- s ... -> e, es, s <- e, ee, se KKss: -> s <- s ... -> e, es <- e, ee, se, ss KXss: -> s ... -> e <- e, ee, se, s, es, ss XKss: <- s ... -> e, es <- e, ee -> s, se, ss IKss: <- s ... -> e, es, s <- e, ee, se, ss XXss: -> e <- e, ee, s, es -> s, se, ss IXss: -> e, s <- e, ee, se, s, es, ss K1Kss: -> s <- s ... -> e, es <- e, ee -> se, ss KK1ss: -> s <- s ... -> e <- e, ee, se, es, ss K1K1ss: -> s <- s ... -> e <- e, ee, es -> se, ss K1Xss: -> s ... -> e <- e, ee, s, es -> se, ss KX1ss: -> s ... -> e <- e, ee, se, s -> es, ss K1X1ss: -> s ... -> e <- e, ee, s -> se, es, ss X1Kss: <- s ... -> e, es <- e, ee -> s <- se, ss XK1ss: <- s ... -> e <- e, ee, es -> s, se, ss X1K1ss: <- s ... -> e <- e, ee, es -> s <- se, ss I1Kss: <- s ... -> e, es, s <- e, ee -> se, ss IK1ss: <- s ... -> e, s <- e, ee, se, es, ss I1K1ss: <- s ... -> e, s <- e, ee, es -> se, ss X1Xss: -> e <- e, ee, s, es -> s <- se, ss XX1ss: -> e <- e, ee, s -> es, s, se, ss X1X1ss: -> e <- e, ee, s -> es, s <- se, ss I1Xss: -> e, s <- e, ee, s, es -> se, ss IX1ss: -> e, s <- e, ee, se, s -> es, ss I1X1ss: -> e, s <- e, ee, s -> se, es, ss _______________________________________________ Noise mailing list <a href="mailto:Noise@moderncrypto.org" target="_blank">Noise@moderncrypto.org</a> <a href="https://moderncrypto.org/mailman/listinfo/noise" rel="noreferrer" target="_blank">https://moderncrypto.org/mailman/listinfo/noise</a> </blockquote></div>