Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Soatok Dreamseeker (soatok@furry.engineer)'s status on Wednesday, 18-Feb-2026 10:01:06 JST Soatok Dreamseeker

   in reply to

   I want to include this excerpt from the Matrix response:

   Your PoC correctly demonstrates that the Olm 3DH implementation in vodozemac does not currently perform the all-zero DH output check. As
   we're sure you're aware, the check for contributory behaviour in X25519 is a contentious topic among cryptographers, with some calling for it, but others like RFC 7748[1] calling it optional or even arguing against it (e.g. Trevor Perrin[2]). We've previously considered adding it but ultimately avoided it due to the conclusion that there's no practical security impact on Matrix. In other places like SAS/ECIES we explicitly reject non-contributory outputs because those handshakes can be used in unauthenticated contexts where an all-zero DH output could directly collapse channel security.

   The [2] points to https://moderncrypto.org/mail-archive/curves/2017/000896.html

   Which is talking about the Diffie-Hellman primitive, not what protocols building atop ECDH should do.