kdog wrote:
Openpgp as standard brings with it a surface that I have to expose to unauthenticated input:
packet stream parsing, S2K, compressed packets, subkey bindings to validate, and above all RSA PKCS#1 v1.5, which is very bad when the failure becomes observable, by timing, by log, by a bounce. A modern envelope must be a single AEAD open: it fails or not, indistinguishably. The OpenPGP path has dozens of points where it can fail differently, and each is a potential cesspool. This is why I keep it isolated in its own module, with size cap before parsing, no compression, mandatory SEIPD and uniform failure. Not because RSA is broken, but because the format forces me this way.
The other half of the problem is that legacy Zax-style nymservs cannot have forward secrecy nor the hSub ratchet: the key is static, by definition. So a seizure while the machine is running retroactively ties them to all their past posts.
Don Jhon wrote:
kdog wrote:
Openpgp as standard brings with it a surface that I have to expose to unauthenticated input:
packet stream parsing, S2K, compressed packets, subkey bindings to validate, and above all RSA PKCS#1 v1.5, which is very bad when the failure becomes observable, by timing, by log, by a bounce. A modern envelope must be a single AEAD open: it fails or not, indistinguishably. The OpenPGP path has dozens of points where it can fail differently, and each is a potential cesspool. This is why I keep it isolated in its own module, with size cap before parsing, no compression, mandatory SEIPD and uniform failure. Not because RSA is broken, but because the format forces me this way.
The other half of the problem is that legacy Zax-style nymservs cannot have forward secrecy nor the hSub ratchet: the key is static, by definition. So a seizure while the machine is running retroactively ties them to all their past posts.
YAMN did the right thing in 2013 and still does: NaCl Box hop-by-hop, AES-256-CTR, Blake2, deterministic header padding against tagging attacks, binomial pooling. It's an honest, living Type II. But it's forward-only, no reply block, no SURB, and that's not a detail: it's what determines the entire architecture of nymserv, and the reason why the code you sent me couldn't work. Maximum chain 10 hops, body 17920 bytes, fixed format.
It's not Sphinx and doesn't have the properties of Katzenpost.
It's my watermark and i assume it.
| Sysop: | Gate Keeper |
|---|---|
| Location: | Shelby, NC |
| Users: | 940 |
| Nodes: | 20 (0 / 20) |
| Uptime: | 497132:05:49 |
| Calls: | 15,889 |
| Calls today: | 14 |
| Files: | 5,345 |
| D/L today: |
4 files (8,192P bytes) |
| Messages: | 680,421 |