Hi Florian,
If I understood Remko correctly he is arguing that because there are no
> non-GPL XEdDSA implementations OMEMO will probably not see any adoption.
>
That was worded a bit hyperbolically, sorry. I meant to say it won't see
*wide* adoption.
> And I think it shouldn't matter right now.
In general, it's correct that the license of the main implementation of a
XEP doesn't matter, as long as the XEP can be reasonably implemented
without it. Implementing double ratchet yourself is reasonable;
implementing your own crypto primitives is neither reasonable nor
responsible.
I see a few ways forward with this:
1. We go back to Olm's protocol of establishing an initial shared secret,
using regular 3DH instead of X3DH.
+ Moves us back to an audited, implementable algorithm
+ No need to change existing identity keys
- This weakens the forward secrecy. I don't know enough about it to
understand the consequence.
2. We replace XEdDSA (the primitive on which X3DH relies) with EdDSA.
+ EdDSA signatures are available in several crypto libraries.
+ Ed25519 keys can be converted to X25519 keys, so the rest of the
algorithm stays the same.
- Identity keys need to be changed to Ed25519 private keys, so existing
keys become invalid.
- I only found 1 implementation for Ed25519 to X25519 key conversion in
an established library, namely LibSodium (permissively licensed). Several
other (permissively licensed) implementations exist in isolation. Not sure
whether other established crypto libraries will follow and implement this.
It's a simple primitive, so it might, but I don't know how these things go.
- This part of the algorithm hasn't been audited.
3. We stay with XEdDSA (the primitive on which X3DH relies)
+ No need to change existing identity keys
+ This approach has been audited.
- Currently, no permissible implementation exists (or I couldn't find
one at least). It's not clear when or if this will ever happen, and whether
it will become widespread across crypto libraries. I don't know how these
things generally go. I have only seen an issue for this in the LibSodium
tracker ( https://github.com/jedisct1/libsodium/issues/335 )
cheers,
Remko
_______________________________________________
Standards mailing list
Info: https://mail.jabber.org/mailman/listinfo/standards
Unsubscribe: [email protected]
_______________________________________________
