[Cryptography] Hohha Protocol : 1. Key renewal review

[Ersin Taskin]

On Mon, Nov 26, 2018 at 4:55 PM Ismail Kizir <ikizir at gmail.com> wrote:

> On Mon, Nov 26, 2018 at 1:52 PM Ersin Taskin <hersintaskin at gmail.com>
> wrote:
> >
> > On Sun, Nov 25, 2018 at 8:42 AM Ismail Kizir <ikizir at gmail.com> wrote:
> > Dear Ismail,
> >
> > Let me wrap up what I have shared regarding Hohha so far in several
> mails:
> >
> > Context I propose: P2P PQ-resistant messaing to be used by ordinary
> people whose security is based on physical habits only. No need for
> pinning,OTP,2FA, 3rd party and very easy to use with the only requirement
> that you physically contact the person you want to communicate PQ-r once at
> least. You do the PSK initialization (creation and sharing) per
> correspondent. Communication is done via any channel (on the Internet) and
> stored anywhere in the cloud.
>
> Dear Ersin,
>
> I didn't plan anything for P2P architecture.


I don't want to put obstacles for legal authorities when they seize the
> phone.

I don't encrypt any data on the phone storage. Everything is plaintext.



My scheme is significantly different as noted. It seems you are progressing
on your own scheme. Good luck. I suggest you to be more explicit on the
term plain text storage i.e. what happens on government seizure vs theft vs
spouse. I think you should focus on what happens if the device is
compromised. My scheme protects the content and yours?
I call my philosophy/model the separation of powers. You separate the
powers of physical relation, communication and storage; and put enough
randomness among each other. This design fits the physical world where the
threat models have a paralel separation of powers structure. So the
attacker must be in god mode to break the system: Get the devices, get the
memorized passwords and/or secretly store all communication, etc. The less
the user does (e.g. skip memorizing a long enough stream for the cloud
service credentials) the less godly the attacker gets. But the
philosophy/model remains the same.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20181127/84ea11ac/attachment.html>