Hi, A few months ago, there were discussions around the OMEMO key agreement protocol, which we said we'd revisit once the XEP was changed to document the historical SIACS protocol, and we then could move on to making OMEMO future-proof. With all that out of the way, i'm picking this up again now.
The problem with the current key agreement is that it relies on XEdDSA, a custom cryptographic primitive, not generally available in established libraries (OpenSSL, LibSodium, ...), blocking further adoption of OMEMO. It would be better for both practical, risk, and consistency reasons to only rely on accepted and widely available cryptographic primitives. One of the proposed solutions was to switch from a single X25519 keypair for both DH and signing keys (using XEdDSA) to an X25519 keypair for DH + an Ed25519 keypair for signing keys (using EdDSA, widely accepted), and tying both keypairs together using a signature. This is also the approach taken by Matrix in their Olm protocol. This impacts the key agreement implementations of existing SIACS clients, but we were hoping people would care less about this once the siacs XEP was published. That said, AFAICT, this stays limited to a (local) change in the implementation only, and doesn't impact the already generated keys: the currently used X25519 keys can be converted to Ed25519 keys (something which XEdDSA relies on already), so existing key validations of your contacts keys don't have to be invalidated. From the user's perspective, only fingerprints that were sent out-of-band between the switch to the new protocol will be invalidated, which is a very limited impact. Any comments on this? thanks, Remko
_______________________________________________ Standards mailing list Info: https://mail.jabber.org/mailman/listinfo/standards Unsubscribe: [email protected] _______________________________________________
