BOLT

ata, for instance, app-key-sge = hmac-sha256(master_key, "social graph encryption") and so on... - Recovery of the secret (by the client): 1. On the client, using user-provided pass-phrase, generate sk, token, and split1, like above. 2. Send the token to a remote machine. If the token is valid, remote lets the client retrieve split2 [8] with which the client can now generate the master-key and app-keys, as before. 3. If the token sent is invalid, remote lets the client retry a very limited number of times before destroying the secret key-pair. --- [0] From the post, ...we’ve been working on new techniques based on secure enclaves and key splitting that are designed to enhance and expand general capabilities for private cloud storage. Our aim is to unlock new possibilities and new functionality within Signal which require cross-platform long-term durable state, while verifiably keeping this state inaccessible to everyone but the user who created it. [1] https://en.wikipedia.org/wiki/Argon2 (end-users prefer shorter passwords but one gets better entropy with longer passwords... which is what Argon2 brings to the table) [2] https://en.wikipedia.org/wiki/HMAC [3] https://github.com/facebookincubator/BOLT (prevents speculative execution exploits: https://en.wikipedia.org/wiki/Speculative_execution) [4] https://blog.quarkslab.com/overview-of-intel-sgx-part-1-sgx-... (used for strict code and hardware attestation) [5] https://www.youtube-nocookie.com/embed/YbZ3zDzDnrw [6] http://www.noiseprotocol.org/ (Wireguard and WhatsApp use it, too, for end-to-end communication) [7] https://eprint.iacr.org/2016/204.pdf [8] Thanks u/jlund: https://news.ycombinator.com/item?id=21839394

s that can be understood (and optimized for) from a higher-level language, but are much harder to deduce from a raw binary (Section 8): > Indirect tail calls are more challenging for static binary rewriters because it is difficult to guess if the target is another function or another basic block of the same function, which could affect the CFG And, the paper touches on your curiosity in the conclusion: > Nevertheless, a post-link optimizer has fewer optimizations than a compiler. We show that the strengths of both strategies combine instead of purely overlapping (Oh, one more post-finally thing, there's probably an argument to be had that BOLT fits into the (backend) superoptimizer category of the paper.)