6 Likes
Hmmmm so if I’m reading this right, Signal truncated an HKDF based on AES to 128 bits from 256. To me, given AES is 128 bit blocks anyway, and generally 128 bit security is often good enough, this is still secure, and probably saves some time on the wire (but at thay point why even use AES-256? Perhaps to keep the option open later?).
But lowering that to 64 is now 64 bit security(?), given the keypair isn’t part of the ratcheting. Combined with increased rotation frequency of 100 to 255, this offers twice the targets to tackle for cryptanalysis as well.
What I wasn’t sure is if the keypair not being part of the ratcheting is a Megolm implementation, or was part of the original spec.
1 Like