On Thu, 3 Mar 2016 16:33:42 +0000 (UTC) lukep <lukep@xxxxxxxxxxxx> wrote: > Hi, > I'm trying to understand the hybrid protocol that's described here. > The server generates the parallel secret PAR_SEC or P and then > computes C = ENCRYPT( P | B | Y, QSPK); > The client decrypts C to get P and then uses it combination with the > ECC secret E: secret_input = E | P | QSPK | ID | PROTOID > > So E is secret, P is generated by the server, QSPK ID and PROTOID are > all public. So IF ECC is broken and IF the server has been > compromised (big IF's!) then everything is known. If the server is compromised, the client loses regardless of handshake mechanism because said compromised server has access to the plaintext. > I guess my point is that the client isnt contributing any secret > information to the quantum-safe part of KEY_SEED. Is that OK? Yes. I'd rather both sides contribute, but since `P | B | Y` is transmitted encrypted to a ephemeral key generated by the client, baring the "the server is compromised" case (which is irrelevant) the construct should hold. See RFC 4432, RFC 5246 7.4.7.1 for this sort of thing being done with RSA. Note: The Ring-LWE variant of this hybrid construct would fulfill the "both sides contribute material" clause (yay). Regards, -- Yawning Angel
Attachment:
pgpflXxItBqN0.pgp
Description: OpenPGP digital signature
_______________________________________________ tor-dev mailing list tor-dev@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev