Oddbean

Sure, I'll explain it in simpler terms. Imagine we're talking about making changes to something important, like a lock on a door that many people use. We want to make sure the lock is strong and secure. 1. One of the ideas being discussed is about how this lock works. Right now, it might not be as secure as we'd like. There's a risk that if we keep using it as it is, it could be easier for someone with bad intentions to figure out how it works. We have a way to make it safer, but it involves some changes to the lock. 2. Another issue is about the way the lock is set up. Right now, the way it's set up could make it easier for someone to break in. We need to make sure the lock is set up in a way that's really hard for people to predict. 3. The lock also has some problems when it's used a lot. The more it's used, the less secure it becomes. If we use it a lot, like thousands of times, it could become very easy for someone to break it. 4. People have already found ways to break this kind of lock in the past, and not all locks are checked properly to make sure they're secure. 5. Finally, the way this lock was designed is based on some assumptions, but those assumptions might not be true in reality. This means the lock could be vulnerable to unknown attacks, making it less safe. So, the question is, should we keep using this lock the way it is, even though it might not be very safe, or should we make some changes to try to make it more secure? That's what's being discussed.

Your private key (nsec) is simply a random number. If someone guesses that random number, they have your private key. The claim here is that every time you send a DM, it makes it easier to guess what that number is.

It doesn’t make sense though, the shared secret is used for encryption. If anything there could be a flaw that leaks the shared secret over time (of some mechanism which I don’t understand), but this shared secret is derived from ECDH. I see no way how the encryption part could leak anything about the original private keys unless something was seriously broken.

ECDH shared secrets reduce entropy on the original key? Wouldn’t this break ECDH ? Couldn’t you create billions of keys to reduce entropy? How does hashing help in this case ? Not adding up for me.

I don't know anything, but here's what GPT has to say: The raw shared secret generated from ECDH should not be used directly as a cryptographic key for a couple of reasons: Predictability: The raw shared secret's value range can be somewhat predictable, especially the beginning and end parts of the secret. This predictability can reduce the entropy of the secret, making it a less secure choice for cryptographic operations. Purpose Differentiation: Without some form of derivation or hashing, the same shared secret will always lead to the same key. This can be problematic if you need different keys for different purposes (e.g., encryption vs. authentication). To mitigate these concerns, it's a common and recommended practice to use a key derivation function (KDF) after obtaining the ECDH shared secret. The KDF can use cryptographic hash functions, like SHA-256 or SHA-3, to derive a more uniform and unpredictable key from the shared secret.

Specifically the shared secret, not the private keys. Even if this is true, its still extraordinary unlikely that you could guess the shared secret, and the damage would be limited to the convo between two people. The claim that DMs will leak your private key is utterly false.

yes this is how I interpreted it, because the shared secret is the only secret involved during encryption. So when people say “dms will leak your private key!” I assumed they meant shared secret. If shared secret could leak private key that would be pretty bad and ECDH would be insecure.

That's better than I thought. The main vulnerability would then be encryption to self since that's done more frequently. But you could use ephemeral keys as a nonce to generate a bogus shared secret.

@DM Leaks Don’t assume because of false assumption rather validate or confirm especially in Age of endless Spam/Scam not only by Fiat paid trolls but also unpaid AI bots for example, there is no such thing a shared secrets including Top Secret where security 3 dimension is about Access rather shared intelligence even in quantum entanglement there is transparency not security like 4 dimension since the piece is part of whole no separation like law of One unlike divorce divided by secrecy cheat means more than one or lack of oneness (unity) by self custody metaphor not your coin not your keys like private key.

so the first and last couple of values of the shared secret string are exposed.. they don't get more exposed then that the more you chat, no? people will still have to try and guess the rest? so is the danger perhaps that the more you dm, the more you expose yourself in a database for being a target for breach? or is it something deeper?

I’m assuming that DMs use asymmetric encryption. Doesn’t that mean that if I send you a DM I’m encrypting it with your public key so you can decrypt it with your private key and vice versa. If usage were to help with guessing the nsec couldn’t someone just constantly use my pubkey to encrypt data until they could “guess the number”. The decryption of the data happens “off network”. Maybe I’m misunderstanding how DMs work but that’s what I originally thought.