{"action":"opened","issue":{"url":"https://api.github.com/repos/keybase/client/issues/2313","repository_url":"https://api.github.com/repos/keybase/client","labels_url":"https://api.github.com/repos/keybase/client/issues/2313/labels{/name}","comments_url":"https://api.github.com/repos/keybase/client/issues/2313/comments","events_url":"https://api.github.com/repos/keybase/client/issues/2313/events","html_url":"https://github.com/keybase/client/issues/2313","id":140546153,"number":2313,"title":"Saltpack Questions and Thoughts","user":{"login":"Phaiax","id":1649278,"avatar_url":"https://avatars.githubusercontent.com/u/1649278?v=3","gravatar_id":"","url":"https://api.github.com/users/Phaiax","html_url":"https://github.com/Phaiax","followers_url":"https://api.github.com/users/Phaiax/followers","following_url":"https://api.github.com/users/Phaiax/following{/other_user}","gists_url":"https://api.github.com/users/Phaiax/gists{/gist_id}","starred_url":"https://api.github.com/users/Phaiax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Phaiax/subscriptions","organizations_url":"https://api.github.com/users/Phaiax/orgs","repos_url":"https://api.github.com/users/Phaiax/repos","events_url":"https://api.github.com/users/Phaiax/events{/privacy}","received_events_url":"https://api.github.com/users/Phaiax/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-14T00:17:14Z","updated_at":"2016-03-14T00:17:14Z","closed_at":null,"body":"Hey\r\n\r\nFrom the specs:\r\n> Repudiability. It's possible for Bob to forge a message that appears to be from Alice. That means that if Bob reveals Alice's message, Alice can deny that she sent it.\r\n\r\nIt should be clarified that this is only true for a one-to-one encryption with only one recipient.\r\nAs far as I understood, the repudiability comes from the fact, that this encryption ...\r\n\r\n> 9 For each recipient, encrypt 32 zero bytes using crypto_box with the recipient's public key, the sender's long-term private key, and the first 24 bytes of the header hash from #8 as a nonce. Take the last 32 bytes of each box. These are the MAC keys.\r\n\r\n... is equivalent to the encryption using the recipients private key and the senders public key\r\nWith multiple recipients, one would need all private keys to fork a message.\r\nIn the case of keybase.io, that would mean all own private device keys and all private keys of all other recipients.\r\n\r\nThe other thought: I think the payload key crypto_boxes order should be explicitly randomized. That would improve forkability and impede investigations. The used order of the recipients and their devices may depend on the time-grown storage structure of the client software. Sorting after public or private keys is not a good idea, since someone who wants to create a fork does not have that information."}}