Embed Notice

This contrived dialogue may have tripped alarms in your mind, even if you're not a nightmare magic math specialist.

If so, this is the same kind of "oh noooooo" I feel whenever a protocol decides which algorithm to use based entirely on potentially attacker-controlled data.

Grabbing the algorithm from a message signature? Bozo bit flipped!

Grabbing the public key from the message signature? I'm over the moon. (Session does this, even though there's an external bit of logic binding it to the user's long-term birationally equivalent X25519 public key.)

The only acceptable way to do this is:

1. Have a randomly generated Key ID that points to a specific keypair.
2. Include this Key ID in the data being authenticated.
3. To figure out the algorithm to use for a given key, consult the key (not the signature or message).