Comment by loup-vaillant
7 years ago
No, email is not bidirectional. You send an email, the recipient later opens it. Sure, the recipient's SMTP server might respond right away with an ephemeral key you can use to enjoy forward secrecy, but that server has to store the message for the recipient to retrieve later.
You can't have full forward secrecy with email as it is used today. If you want forward secrecy with email, you need three emails sent in rapid succession: Alice sends a request to Bob, Bob sends a response to accept the request, and Alice sends the actual encrypted email. That would work. But you basically need Bob to be online.
> you need three emails sent in rapid succession
This is partially correct, but they do not need to be in rapid succession, and therefore Bob does not need to be online.
Alice's ephemeral private key must be kept as long as the whole handshake. Bob's is a bit shorter (between the last two messages).
If the messages are slow to come, those ephemeral keys become less and less ephemeral, and could actually be stolen.
That is exactly correct. As I'm sure you know, it is Alice that retains her DH key not the email server or anyone else. As I said:
> If your security model relies on this difference then your security model is broken. It’s worth noting that Signal does NOT rely on this difference. It relies on participants being mostly online to permit frequent rekeys and not having to retain old keys indefinitely.
Signal does not depend on TCP being "bidirectional" as lvh said, it depends on participants being mostly online. This has nothing to do with the transport properties of e-mail vs. TCP.
2 replies →