this post was submitted on 13 Oct 2025
82 points (100.0% liked)

Technology

6842 readers
272 users here now

News community around technology, social media platforms, information technology and governmental policy surrounding it.

What doesn't fit here?

The core of the story has to be technology focused.


Post guidelines

Title formatPost title should mirror the news source title. If you don't like the title of article, look for an alternative source instead of editorializing it.
URL formatPost URL should be the original link to the article (even if paywalled) and archived copies left in the body. It allows avoiding duplicate posts when cross-posting.
[Opinion] prefixOpinion (op-ed) articles must use [Opinion] prefix before the title. Opinion articles refer to articles that their publisher doesn't explictly endorse.
Country prefixCountry prefix can be added to the title with a separator (|, :, etc.) if the news is from a local publisher who doesn't clearly mention the country.


Rules

1. English onlyTitle and associated content has to be in English.
2. Use original linkPost URL should be the original link to the article (even if paywalled) and archived copies left in the body. It allows avoiding duplicate posts when cross-posting.
3. Respectful communicationAll communication has to be respectful of differing opinions, viewpoints, and experiences.
4. InclusivityEveryone is welcome here regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
5. Ad hominem attacksAny kind of personal attacks are expressly forbidden. If you can't argue your position without attacking a person's character, you already lost the argument.
6. Off-topic tangentsStay on topic. Keep it relevant.
7. Instance rules may applyIf something is not covered by community rules, but are against lemmy.zip instance rules, they will be enforced.


Companion communities

!globalnews@lemmy.zip
!interestingshare@lemmy.zip


Icon attribution | Banner attribution


If someone is interested in moderating this community, message @brikox@lemmy.zip.

founded 2 years ago
MODERATORS
 

New design sets a high standard for post-quantum readiness.

you are viewing a single comment's thread
view the rest of the comments
[–] ignirtoq@fedia.io 12 points 7 months ago (3 children)

While a TLS uses the same key throughout a session, keys within a Signal session constantly evolve.

What are we defining as a "session" for Signal? The vast majority of TLS sessions exist for the duration of pulling down a web page. Dynamically interact with that page? New HTTP request backed by a new TLS session. Sure, there are exceptions like WebSockets, but by and large TLS sessions are often short.

Is a Signal session the duration of sending a single message? An entire conversation? The entire time you have someone in your address book? It doesn't seem like an apples-to-apples comparison.

[–] jacksilver@lemmy.world 6 points 7 months ago

I think the biggest thing here is that beyond just a session key (to make sessions secure from each other), this approach uses a rotating session key. That means each transaction in a sesssion is unique ensuring forward and backward secrecy.

I may have read it wrong plus cybersecurity is not my forte.

[–] The_Decryptor@aussie.zone 4 points 7 months ago

TLS can do key rotation too, it's just not needed in practice. The QUIC RFCs talk about it a bit, e.g. when using ChaCha20 the key usage limit is actually larger than the defined limit for transmitted data, making it only potentially relevant for AES.

[–] Valmond@lemmy.world 2 points 7 months ago

Isn't asymmetric used for the handshake only? And then like AES or something which have evolving keys (and are quite quantum resistant).