this post was submitted on 13 Oct 2025
82 points (100.0% liked)

Technology

5066 readers
789 users here now

Which posts fit here?

Anything that is at least tangentially connected to the technology, social media platforms, informational technologies and tech policy.

Post guidelines

[Opinion] prefixOpinion (op-ed) articles must use [Opinion] prefix before the title.

Rules

1. English onlyTitle and associated content has to be in English.
2. Use original linkPost URL should be the original link to the article (even if paywalled) and archived copies left in the body. It allows avoiding duplicate posts when cross-posting.
3. Respectful communicationAll communication has to be respectful of differing opinions, viewpoints, and experiences.
4. InclusivityEveryone is welcome here regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
5. Ad hominem attacksAny kind of personal attacks are expressly forbidden. If you can't argue your position without attacking a person's character, you already lost the argument.
6. Off-topic tangentsStay on topic. Keep it relevant.
7. Instance rules may applyIf something is not covered by community rules, but are against lemmy.zip instance rules, they will be enforced.

Companion communities

!globalnews@lemmy.zip
!interestingshare@lemmy.zip

Icon attribution | Banner attribution

If someone is interested in moderating this community, message @brikox@lemmy.zip.

founded 2 years ago
MODERATORS
BrikoX@lemmy.zip
82
Why Signal’s post-quantum makeover is an amazing engineering achievement (arstechnica.com)
submitted 2 months ago by BrikoX@lemmy.zip to c/technology@lemmy.zip
9 comments fedilink hide all child comments
 

New design sets a high standard for post-quantum readiness.

top 9 comments
sorted by: hot top controversial new old
[–] ignirtoq@fedia.io 12 points 2 months ago (3 children)

While a TLS uses the same key throughout a session, keys within a Signal session constantly evolve.

What are we defining as a "session" for Signal? The vast majority of TLS sessions exist for the duration of pulling down a web page. Dynamically interact with that page? New HTTP request backed by a new TLS session. Sure, there are exceptions like WebSockets, but by and large TLS sessions are often short.

Is a Signal session the duration of sending a single message? An entire conversation? The entire time you have someone in your address book? It doesn't seem like an apples-to-apples comparison.

[–] jacksilver@lemmy.world 6 points 2 months ago

I think the biggest thing here is that beyond just a session key (to make sessions secure from each other), this approach uses a rotating session key. That means each transaction in a sesssion is unique ensuring forward and backward secrecy.

I may have read it wrong plus cybersecurity is not my forte.

[–] The_Decryptor@aussie.zone 4 points 2 months ago

TLS can do key rotation too, it's just not needed in practice. The QUIC RFCs talk about it a bit, e.g. when using ChaCha20 the key usage limit is actually larger than the defined limit for transmitted data, making it only potentially relevant for AES.

[–] Valmond@lemmy.world 2 points 2 months ago

Isn't asymmetric used for the handshake only? And then like AES or something which have evolving keys (and are quite quantum resistant).

[–] AntiBullyRanger@ani.social 4 points 2 months ago (1 children)

How is this different than SimpleX’s NTRU algorithm?

[–] jacksilver@lemmy.world 4 points 2 months ago (1 children)

I believe it's the same thing I noted in another comment - https://lemmy.world/comment/19924290

Basically session key vs rotating session key, but to be honest I only skimmed your link as it got dense fast.

[–] AntiBullyRanger@ani.social 3 points 2 months ago

SimpleX has that with temporary addresses.

[–] 0x0@lemmy.zip 2 points 2 months ago (1 children)

Do they still require a phone number?

[–] BrikoX@lemmy.zip 1 points 2 months ago

Only for account creation, afterwards you can hide it and use username.