Noise Explorer beta

XN

a e b e, ee c s, se d e

Handshake Pattern Analysis

Message A show detailed analysis

Message A, sent by the initiator, does not benefit from sender authentication and does not provide message integrity. It could have been sent by any party, including an active attacker. Message contents are sent in cleartext and do not benefit from message secrecy and any forward secrecy is out of the question. 0,0

Message B show detailed analysis

Message B, sent by the responder, does not benefit from sender authentication and does not provide message integrity. It could have been sent by any party, including an active attacker. Message contents benefit from some message secrecy and some forward secrecy, but not sufficiently to resist any active attacker. 0,1

Message C show detailed analysis

Message C, sent by the initiator, benefits from sender authentication and is resistant to Key Compromise Impersonation. Assuming the corresponding private keys are secure, this authentication cannot be forged. However, if the initiator carries out a separate session with a separate, compromised responder, this other session can be used to forge the authentication of this message with this session's responder. Message contents benefit from some message secrecy and some forward secrecy, but not sufficiently to resist any active attacker. 2,1

Message D show detailed analysis

Message D, sent by the responder, does not benefit from sender authentication and does not provide message integrity. It could have been sent by any party, including an active attacker. Message contents benefit from message secrecy and strong forward secrecy: if the ephemeral private keys are secure and the initiator is not being actively impersonated by an active attacker, message contents cannot be decrypted. 0,5

Message E show detailed analysis

Message E, sent by the initiator, benefits from sender authentication and is resistant to Key Compromise Impersonation. Assuming the corresponding private keys are secure, this authentication cannot be forged. However, if the initiator carries out a separate session with a separate, compromised responder, this other session can be used to forge the authentication of this message with this session's responder. Message contents benefit from some message secrecy and some forward secrecy, but not sufficiently to resist any active attacker. 2,1

Download Cryptographic Models for Formal Verification

Download Model active attacker Download Model passive attacker