[noise] Why encrypted keys are authenticated?

[Loup Vaillant David]

> > (Honest question: does the attack above look like it would work? It
> > only takes one such example to settle the issue once and for all.)
> 
> Sure, if the app inspects the public key after it's decrypted but
> before it's authenticated you'd have to worry about things like that.

OK, so that's one attack…

> I'm not sure X25519 functions consistently treat the other party's
> public key as a "secret input", that's kind of an edge case.  For
> example, some X25519 implementations will behave differently (return
> an error value) if given a small-order public key, and public-key
> validation is also common for some other types of public keys.

…Aaand that's two. I believe  Libsodium does such validation.

Okay, I give up. Moxie was right: I'm doomed. You were right: we need
those "redundant" tags.


> So I'm not sure your reasoning about "constant time" crypto code
> making this safe is correct.

It was not. I was assuming too much, based on one implementation only
(my own). I should have known better: DJB himself designed his curve in
a way that mitigates some classes of leaks. You did the same with
Noise, and so should I have.

Loup.