13
Cryptographic Issues in Matrix’s Rust Library Vodozemac (soatok.blog)
submitted 8 months ago by [B] to c/pulse_of_truth@infosec.pub
12 comments fedilink hide all child comments
 

Comments

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 8 months ago* (5 children)

Where? It's all TLS and NTRU prime now to my knowledge. They have a couple audits now.

https://github.com/simplex-chat/simplex-chat/blob/stable/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.md

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 8 months ago (4 children)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 8 months ago (3 children)

    3 year old subpackage blob. Maybe it's from before the switch to PQC? They have a published threat model that helped guide the audits and seemed well reasoned. I'm not sure where that version of curve would be used in the current client or server.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 8 months ago (2 children)

    Either way, it's just... weird.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 8 months ago (1 child)

    you can message the developers directly from the client. Ask, if they dont know why it's there it'll get stripped out. I would guess it's legacy compatibility but it could be zombie code that needs pruned

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •