On 02/05/2014 10:12 PM, Trevor Perrin wrote: > I also think that fingerprints and > "introduction secrets" may be complementary instead of mutually > exclusive.
This is an important point -- these two ways of peer authentication
actually have pretty different semantics, and both semantics are
important in different use cases. in particular:
Introduction Secrets
--------------------
* private
* ephemeral
* active
* one-to-one (unicast)
* third-party introductions are trackable/spoofable by the introducer
Fingerprints
-------------
* public
* persistent
* passive
* one-to-many (broadcast)
* third-party introductions can be both "blind" (the introducer doesn't
know who is using the introduction) and auditable (the introducer can be
held to account for spoofing).
it would be great to talk over some of the tradeoffs here if folks are
interested (though i'm happy to let the fingerprint discussion wrap up
first).
--dkg
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Messaging mailing list [email protected] https://moderncrypto.org/mailman/listinfo/messaging
