Subject: Re: [Endymail] [messaging] Mesh/Recrypt

From: Tony Arcieri <[email-masked]>
Date: Mon, 22 Aug 2016 19:48:33 -0700

On Mon, Aug 22, 2016 at 4:48 PM, Phillip Hallam-Baker <[email-masked]
> wrote:

> ​I suggested followups to the [email-masked] mailing list rather than
> CFRG though.
>

Ok, CC'd! That said, here's a followup:

I was kind of confused why you cite RFC7748, but then go on to explain
things in terms of classical Diffie-Hellman.

As far as an ECC-based approach goes, I think something like the multiparty
Signal protocol[1] is a good starting point for how to solve the general
problem, and, as far as I can tell, addresses most of the concerns you
cited as a motivation.

The specific approach you detailed could be adapted to ECC as well.

[1] I'm not sure there's a more recent overview than this, which is
probably out-of-date: https://whispersystems.org/blog/private-groups/

-- 
Tony Arcieri

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 22 Aug 2016 22:57:45 -0400

On Mon, Aug 22, 2016 at 10:48 PM, Tony Arcieri <[email-masked]> wrote:

> On Mon, Aug 22, 2016 at 4:48 PM, Phillip Hallam-Baker <
> [email-masked]> wrote:
>

​A limitation in my development environment​. I have classical DH and NIST
curves. But I don't have the new curves or the abilty to do the EC math
outside the crypto library so I can't to the recryption at the mo.

> probably out-of-date: https://whispersystems.org/blog/private-groups/
​The math is very similar and they can probably adapt very easily. The
difference is that their problem statement is for synchronous communication
with all the parties present for the key exchange. Recryption allows the
asynchronous case to be supported as well.

The CDC problem is essentially the problem of how do I mark a document with
a security label in a way that the administrator of the security label can
grant access to a new reader by adding them to the label.

I will read up on that though, thanks!​

---

From: Andy Isaacson <[email-masked]>
Date: Sun, 28 Aug 2016 17:59:47 -0700

>Signal protocol[1] is a good starting point for how to solve the general

[snip]

>probably out-of-date: https://whispersystems.org/blog/private-groups/

Based on a bit of experimenting with the various language 
implementations of libsignal, I'm pretty sure Signal group messages 
don't do the encrypt-to-each-recipient thing anymore.  But I haven't 
tried to interoperate with or even study the mainline client, so it's 
possible I'm missing something.

-andy