[Cryptography] Preventing correlation on rebinding connection identifiers.

[jrzx]

To to avoid leaking metadata, use short lived secrets liberally, and mix them with long lived secrets for deniable authentication with perfect forward secrecy..

Every conversation should be start with encryption based on a single use secret, and to the extent that authentication is required, switch to encryption based on a combination of that short lived secret with a long lived secret.

Alice whose durable elliptic point is *A*, generates a random short lived single use scalar *x* and corresponding elliptic point *X*', and initiates a conversation with an entity she hopes is Bob, whose durable elliptic point is *B*

Alice says to Bob, in the clear:
"Hello, is Bob there? Let us use X for our shared secret.

Alice then continues, encrypting with the shared secret xB=bX
*"This is Alice"
If Bob understands, she has the right Bob. But Bob does not yet know he has the right Alice.

Alice then continues, encrypting with the shared secret *(a+x)B*

Bob decrypts with the shared secret *b(A+X)*

Now Bob knows he has the right Alice. But he cannot prove it to anyone else, and even should his or Alice's keys leak no one can retroactively decrypt the conversation.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20210212/6807299c/attachment.htm>