<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ian Goldberg wrote:
<blockquote cite="mid20050328192008.GH30200@smtp.paip.net" type="cite">
<pre wrap="">[It's "perfect forward secrecy", not "p.f. security".]
On Mon, Mar 28, 2005 at 01:59:41PM -0500, Jason Cohen wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Quoting:
The keysize of the DH only has to be large enough that you're
comfortable with the adversary having to break a DH key agreement *per
message*, since (approximately) each message you send is encrypted
with a new key, derived from a fresh DH key agreement.
If an adversary steals your private key and can break one message,
don't they have all the needed information to decrypt the next
message? They have the key used to encrypt the next message as well as
the private "x" value. I'm probably just confused. I would appreciate
it if someone could clarify this for me.
</pre>
</blockquote>
<pre wrap=""><!---->
No; if you break DH to find the private key associated with the public
key used to encrypt message number 1, that doesn't give you the private
key associated with the public key used to encrypt message number 2.
Each message (approximately) uses a brand-new DH private/public key
pair. You have to break DH all over again to get that second private
key, and so on. Knowing the DSA private key also has no effect on this
result.
I'm not sure that was clear enough. Let me know if there's something
you still don't understand.
- Ian
_______________________________________________
OTR-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OTR-users@lists.cypherpunks.ca">OTR-users@lists.cypherpunks.ca</a>
<a class="moz-txt-link-freetext" href="http://lists.cypherpunks.ca/mailman/listinfo/otr-users">http://lists.cypherpunks.ca/mailman/listinfo/otr-users</a>
</pre>
</blockquote>
Maby I can make it a bit more clear. You have a public and a private
key. You encrypt with the public key and decrypt with the private key.
If you only have the pub key, you can't decode the message. <br>
If you calculate the 1st private key (wich takes lots of time) all you
get is the 1st message and the secound public key. Now you have to
calculate the secound private Key (wich takes a lots of time again) to
decode the secound message and get the third public key, and so on.<br>
As you "forget" your private key as soon as you don't need it any more
there is no way to get it then to calculate the Private key from the
public key, wich as alreade mentioned taks lots of time.<br>
Hope this maks things a bit more clear.<br>
morty<br>
<br>
<div class="moz-signature">-- <br>
<p>Diese Email ist signiert. Solltest Du von mir eine nicht signierte
Mail bekommen und das Gefühl haben, dass sie nicht von mir stammt, ist
dies wahrscheinlich der Fall. Sollte Dein Email-Client keine Signaturen
unterstützen wird eine smime.p7s-Datei im Anhang angeziegt.</p>
<p><a href="http://www.mozilla-world.org"><img alt="Get Firefox!"
title="Get Firefox!" src="cid:part1.06000108.01010908@gmx.net"
moz-do-not-send="false/" border="0"> - Den besten Browser jetzt in
Version 1.0.1, Deutsch runterladen!</a></p>
</div>
</body>
</html>