Comment on A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water
Natanael@slrpnk.net 6 months agoMessage logs doesn’t break forward secrecy in a cryptographic sense, retaining original asymmetric decryption keys (or method to recreate them) does. Making history editable would help against that too.
What Signal actually intends is to limit privacy leaks, it only allows history transfer when you transfer the entire account to another device and “deactivate” the account on the first one, so you can’t silently get access to all of somebody’s history
JoeyJoeJoeJr@lemmy.ml 6 months ago
You’re describing something very different - you already have the messages, and you already have them decrypted. You can transfer them without the keys. If someone gets your device, they have them, too.
Whether Signal keeps the encrypted the messages or not, a new device has no way of getting the old messages from the server.
Natanael@slrpnk.net 6 months ago
I run a cryptography forum, I know the exact definition of these terms. Message logs in plaintext is very distinct from forward secrecy. What forward secrecy means in particular is that captured network traffic can’t be decrypted later even if you at a later point can steal the user’s keys (because the session used session keys that were later deleted).
You can transfer messages as a part of an account transfer on Signal (at least on Android). This deactivates the app on the old device (so you can’t do it silently to somebody’s device)
JoeyJoeJoeJr@lemmy.ml 6 months ago
I would argue that it is not limited to network traffic, it is the general concept that historical information is not compromised, even if current (including long-term) secrets are compromised.
From my comment earlier:
This describes devices linked to an account, where each is retrieving messages from the server - not a point-to-point transfer, which is how data is transferred from one Android device to another. If a new device could retrieve and decrypt old messages on the server, that would be a breach of the forward security concept.
Natanael@slrpnk.net 6 months ago
I run a cryptography subreddit and it’s a term defined by professional cryptographers.
www.sectigo.com/…/perfect-forward-secrecy
link.springer.com/…/978-1-4419-5906-5_90
www.sciencedirect.com/topics/…/forward-secrecy
Literally all definitions speak of network traffic and leaked / extracted encryption keys. PFS is about using short term keys that you delete so that they can not leak later.
Backup and sync via a separate mechanism is not a PFS violation. In particular because they’re independent of that same encrypted session. It’s entirely a data retention security issue.
Matrix.org supports message log backup via the server, and does so by uploading encrypted message logs and syncing the keys between clients. You can delete the logs later, or delete your keys, or even push fake logs if you want. It’s still happening outside of the original encrypted session and the adversary can’t confirm what actually was said and