aboutsummaryrefslogtreecommitdiff
path: root/docs/signing.md
diff options
context:
space:
mode:
authorRichard van der Hoff <richard@matrix.org>2019-11-08 14:09:12 +0000
committerRichard van der Hoff <richard@matrix.org>2019-11-08 14:09:12 +0000
commit04690658558fd84cd635ee8dd34b163cccfcf420 (patch)
tree6a00e91781d2efe8dfb112fa6ac64ee12b424986 /docs/signing.md
parentbaaf00266314487f831726d7cb34ee2649f99e22 (diff)
parent5bcfeaffe3d465a16e472e98c99d6970e8dc80d8 (diff)
Merge branch 'rav/fix_math' into 'master'
Fix some math blocks See merge request matrix-org/olm!10
Diffstat (limited to 'docs/signing.md')
-rw-r--r--docs/signing.md12
1 files changed, 7 insertions, 5 deletions
diff --git a/docs/signing.md b/docs/signing.md
index fcc5342..58a2b5e 100644
--- a/docs/signing.md
+++ b/docs/signing.md
@@ -49,13 +49,14 @@ compromised keys, and sends a pre-key message using a shared secret $`S`$,
where:
```math
-S = ECDH\left(I_A,\,E_E\right)\;\parallel\;ECDH\left(E_A,\,I_B\right)\;
- \parallel\;ECDH\left(E_A,\,E_E\right)
+S = ECDH\left(I_A,E_E\right)\;\parallel\;
+ ECDH\left(E_A,I_B\right)\;\parallel\;
+ ECDH\left(E_A,E_E\right)
```
Eve cannot decrypt the message because she does not have the private parts of
either $`E_A`$ nor $`I_B`$, so cannot calculate
-$`ECDH\left(E_A,\,I_B\right)`$. However, suppose she later compromises
+$`ECDH\left(E_A,I_B\right)`$. However, suppose she later compromises
Bob's identity key $`I_B`$. This would give her the ability to decrypt any
pre-key messages sent to Bob using the compromised one-time keys, and is thus a
problematic loss of forward secrecy. If Bob signs his keys with his Ed25519
@@ -66,8 +67,9 @@ On the other hand, signing the one-time keys leads to a reduction in
deniability. Recall that the shared secret is calculated as follows:
```math
-S = ECDH\left(I_A,\,E_B\right)\;\parallel\;ECDH\left(E_A,\,I_B\right)\;
- \parallel\;ECDH\left(E_A,\,E_B\right)
+S = ECDH\left(I_A,E_B\right)\;\parallel\;
+ ECDH\left(E_A,I_B\right)\;\parallel\;
+ ECDH\left(E_A,E_B\right)
```
If keys are unsigned, a forger can make up values of $`E_A`$ and