This commit is contained in:
epoberezkin committed 2024-06-16 15:25:25 +00:00
1 parent 9d4830e128
commit 5c3cf40f7e
89 files changed
+2302 -1366

No files matched your search

+57 -46
View File
@@ -858,43 +858,43 @@ window.addEventListener('scroll',changeHeaderBg);
</div>
</div>
</div>
<div><p>| Updated 28.05.2024 | Languages: EN, <a href="/docs/lang/fr/server.html">FR</a>, <a href="/docs/lang/cs/server.html">CZ</a>, <a href="/docs/lang/pl/server.html">PL</a> |</p>
<div><html><head></head><body><p>| Updated 28.05.2024 | Languages: EN, <a href="/docs/lang/fr/server.html">FR</a>, <a href="/docs/lang/cs/server.html">CZ</a>, <a href="/docs/lang/pl/server.html">PL</a> |</p>
<h3 id="table-of-contents" tabindex="-1">Table of Contents</h3>
<ul>
<li><a href="#hosting-your-own-smp-server">Hosting your own SMP server</a>
<li><a href="undefined">Hosting your own SMP server</a>
<ul>
<li><a href="#overview">Overview</a></li>
<li><a href="#installation">Installation</a></li>
<li><a href="#configuration">Configuration</a>
<li><a href="undefined">Overview</a></li>
<li><a href="undefined">Installation</a></li>
<li><a href="undefined">Configuration</a>
<ul>
<li><a href="#interactively">Interactively</a></li>
<li><a href="#via-command-line-options">Via command line options</a></li>
<li><a href="undefined">Interactively</a></li>
<li><a href="undefined">Via command line options</a></li>
</ul>
</li>
<li><a href="#further-configuration">Further configuration</a></li>
<li><a href="#server-security">Server security</a>
<li><a href="undefined">Further configuration</a></li>
<li><a href="undefined">Server security</a>
<ul>
<li><a href="#initialization">Initialization</a></li>
<li><a href="#private-keys">Private keys</a></li>
<li><a href="#online-certificate-rotation">Online certificate rotation</a></li>
<li><a href="undefined">Initialization</a></li>
<li><a href="undefined">Private keys</a></li>
<li><a href="undefined">Online certificate rotation</a></li>
</ul>
</li>
<li><a href="#tor-installation-and-configuration">Tor: installation and configuration</a>
<li><a href="undefined">Tor: installation and configuration</a>
<ul>
<li><a href="#installation-for-onion-address">Installation for onion address</a></li>
<li><a href="#socks-port-for-smp-proxy">SOCKS port for SMP PROXY</a></li>
<li><a href="undefined">Installation for onion address</a></li>
<li><a href="undefined">SOCKS port for SMP PROXY</a></li>
</ul>
</li>
<li><a href="#server-information-page">Server information page</a></li>
<li><a href="#documentation">Documentation</a>
<li><a href="undefined">Server information page</a></li>
<li><a href="undefined">Documentation</a>
<ul>
<li><a href="#smp-server-address">SMP server address</a></li>
<li><a href="#systemd-commands">Systemd commands</a></li>
<li><a href="#monitoring">Monitoring</a></li>
<li><a href="undefined">SMP server address</a></li>
<li><a href="undefined">Systemd commands</a></li>
<li><a href="undefined">Monitoring</a></li>
</ul>
</li>
<li><a href="#updating-your-smp-server">Updating your SMP server</a></li>
<li><a href="#configuring-the-app-to-use-the-server">Configuring the app to use the server</a></li>
<li><a href="undefined">Updating your SMP server</a></li>
<li><a href="undefined">Configuring the app to use the server</a></li>
</ul>
</li>
</ul>
@@ -902,7 +902,7 @@ window.addEventListener('scroll',changeHeaderBg);
<h2 id="overview" tabindex="-1">Overview</h2>
<p>SMP server is the relay server used to pass messages in SimpleX network. SimpleX Chat apps have preset servers (for mobile apps these are smp11, smp12 and <a href="http://smp14.simplex.im">smp14.simplex.im</a>), but you can easily change app configuration to use other servers.</p>
<p>SimpleX clients only determine which server is used to receive the messages, separately for each contact (or group connection with a group member), and these servers are only temporary, as the delivery address can change.</p>
<p><em>Please note</em>: when you change the servers in the app configuration, it only affects which servers will be used for the new contacts, the existing contacts will not automatically move to the new servers, but you can move them manually using <a href="/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html#change-your-delivery-address-beta">&quot;Change receiving address&quot;</a> button in contact/member information pages – it will be automated in the future.</p>
<p><em>Please note</em>: when you change the servers in the app configuration, it only affects which servers will be used for the new contacts, the existing contacts will not automatically move to the new servers, but you can move them manually using <a href="/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html">"Change receiving address"</a> button in contact/member information pages – it will be automated in the future.</p>
<h2 id="installation" tabindex="-1">Installation</h2>
<ol>
<li>
@@ -959,7 +959,7 @@ sudo firewall-cmd --reload
</code></pre>
</li>
<li>
<p><strong>Optional</strong> — If you're using distribution with <code>systemd</code>, create <code>/etc/systemd/system/smp-server.service</code> file with the following content:</p>
<p><strong>Optional</strong>&nbsp;— If you're using distribution with <code>systemd</code>, create <code>/etc/systemd/system/smp-server.service</code> file with the following content:</p>
<pre><code class="language-sh">[Unit]
Description=SMP server systemd service
@@ -968,7 +968,7 @@ User=smp
Group=smp
Type=simple
ExecStart=/usr/local/bin/smp-server start +RTS -N -RTS
ExecStopPost=/usr/bin/env sh -c '[ -e &quot;/var/opt/simplex/smp-server-store.log&quot; ] &amp;&amp; cp &quot;/var/opt/simplex/smp-server-store.log&quot; &quot;/var/opt/simplex/smp-server-store.log.bak&quot;'
ExecStopPost=/usr/bin/env sh -c '[ -e "/var/opt/simplex/smp-server-store.log" ] &amp;&amp; cp "/var/opt/simplex/smp-server-store.log" "/var/opt/simplex/smp-server-store.log.bak"'
LimitNOFILE=65535
KillSignal=SIGINT
TimeoutStopSec=infinity
@@ -991,11 +991,11 @@ Available commands:
/etc/opt/simplex/smp-server.ini)
delete Delete configuration and log files
</code></pre>
<p>You can get further help by executing <code>sudo su smp -c &quot;smp-server &lt;command&gt; -h&quot;</code></p>
<p>You can get further help by executing <code>sudo su smp -c "smp-server &lt;command&gt; -h"</code></p>
<p>After that, we need to configure <code>smp-server</code>:</p>
<h3 id="interactively" tabindex="-1">Interactively</h3>
<p>Execute the following command:</p>
<pre><code class="language-sh">sudo su smp -c &quot;smp-server init&quot;
<pre><code class="language-sh">sudo su smp -c "smp-server init"
</code></pre>
<p>There are several options to consider:</p>
<ul>
@@ -1022,7 +1022,7 @@ Available commands:
</ul>
<h3 id="via-command-line-options" tabindex="-1">Via command line options</h3>
<p>Execute the following command:</p>
<pre><code class="language-sh">sudo su smp -c &quot;smp-server init -h&quot;
<pre><code class="language-sh">sudo su smp -c "smp-server init -h"
...
Available options:
@@ -1032,7 +1032,7 @@ Available options:
ED25519, ED448 (default: ED448)
--ip IP Server IP address, used as Common Name for TLS online
certificate if FQDN is not supplied
(default: &quot;127.0.0.1&quot;)
(default: "127.0.0.1")
-n,--fqdn FQDN Server FQDN used as Common Name for TLS online
certificate
--no-password Allow creating new queues without password
@@ -1042,10 +1042,10 @@ Available options:
-h,--help Show this help text
</code></pre>
<p>You should determine which flags are needed for your use-case and then execute <code>smp-server init</code> with <code>-y</code> flag for non-interactive initialization:</p>
<pre><code class="language-sh">sudo su smp -c &quot;smp-server init -y -&lt;your flag&gt; &lt;your option&gt;&quot;
<pre><code class="language-sh">sudo su smp -c "smp-server init -y -&lt;your flag&gt; &lt;your option&gt;"
</code></pre>
<p>For example, run:</p>
<pre><code class="language-sh">sudo su smp -c &quot;smp-server init -y -l --ip 192.168.1.5 --password test&quot;
<pre><code class="language-sh">sudo su smp -c "smp-server init -y -l --ip 192.168.1.5 --password test"
</code></pre>
<p>to initialize your <code>smp-server</code> configuration with:</p>
<ul>
@@ -1202,7 +1202,7 @@ static_path: /var/opt/simplex/www
<p>Destroy the container. All relevant configuration files and keys will be available at <code>$HOME/simplex/smp/config</code>.</p>
</li>
<li>
<p>Move your <code>CA</code> private key (<code>ca.key</code>) to the safe place. For further explanation, see the next section: <a href="#private-keys">Server security: Private keys</a>.</p>
<p>Move your <code>CA</code> private key (<code>ca.key</code>) to the safe place. For further explanation, see the next section: <a href="undefined">Server security: Private keys</a>.</p>
</li>
<li>
<p>Copy all other configuration files <strong>except</strong> the CA key to the server:</p>
@@ -1229,7 +1229,7 @@ static_path: /var/opt/simplex/www
</code></pre>
</li>
<li>
<p>Delete the CA key from the server. <strong>Please make sure you've saved you CA key somewhere safe. Otherwise, you would lose the ability to <a href="#online-certificate-rotation">rotate the online certificate</a></strong>:</p>
<p>Delete the CA key from the server. <strong>Please make sure you've saved you CA key somewhere safe. Otherwise, you would lose the ability to <a href="undefined">rotate the online certificate</a></strong>:</p>
<pre><code class="language-sh">rm /etc/opt/simplex/ca.key
</code></pre>
</li>
@@ -1293,7 +1293,7 @@ $HOME/simplex/smp/config/ca.key
</li>
<li>
<p>Connect to the server via SSH and restart the service:</p>
<pre><code class="language-sh">ssh &lt;server_user&gt;@&lt;server_address&gt; &quot;systemctl restart smp-server&quot;
<pre><code class="language-sh">ssh &lt;server_user&gt;@&lt;server_address&gt; "systemctl restart smp-server"
</code></pre>
</li>
<li>
@@ -1310,9 +1310,9 @@ $HOME/simplex/smp/config/ca.key
<ul>
<li>
<p>Configure offical Tor PPA repository:</p>
<pre><code class="language-sh">CODENAME=&quot;$(lsb_release -c | awk '{print $2}')&quot;
echo &quot;deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org ${CODENAME} main
deb-src [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org ${CODENAME} main&quot; &gt; /etc/apt/sources.list.d/tor.list
<pre><code class="language-sh">CODENAME="$(lsb_release -c | awk '{print $2}')"
echo "deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org ${CODENAME} main
deb-src [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org ${CODENAME} main" &gt; /etc/apt/sources.list.d/tor.list
</code></pre>
</li>
<li>
@@ -1376,7 +1376,7 @@ HiddenServicePort 5223 localhost:5223
<p>SMP-server versions starting from <code>v5.8.0-beta.0</code> can be configured to PROXY smp servers available exclusively through <a href="https://www.torproject.org">Tor</a> network to be accessible to the clients that do not use Tor. Run the following commands as <code>root</code> user.</p>
<ol>
<li>
<p>Install tor as described in the <a href="#installation-for-onion-address">previous section</a>.</p>
<p>Install tor as described in the <a href="undefined">previous section</a>.</p>
</li>
<li>
<p>Execute the following command to creatae a new Tor daemon instance:</p>
@@ -1402,7 +1402,7 @@ SocksPort 9050
</code></pre>
</li>
<li>
<p>After <a href="#configuration">server initialization</a>, configure the <code>PROXY</code> section like so:</p>
<p>After <a href="undefined">server initialization</a>, configure the <code>PROXY</code> section like so:</p>
<pre><code class="language-ini">...
[PROXY]
socks_proxy: 127.0.0.1:9050
@@ -1502,7 +1502,7 @@ hosting_country: &lt;HOSTING_PROVIDER_LOCATION&gt;
</code></pre>
</li>
<li>
<p>Upgrade your smp-server to latest version - <a href="#updating-your-smp-server">Updating your smp server</a></p>
<p>Upgrade your smp-server to latest version - <a href="undefined">Updating your smp server</a></p>
</li>
<li>
<p>Access the webpage you've deployed from your browser. You should see the smp-server information that you've provided in your ini file.</p>
@@ -1642,7 +1642,7 @@ Nov 23 19:23:21 5588ab759e80 smp-server[30878]: creating new queues requires pas
<td>Active queues in a month</td>
</tr>
<tr>
<td>Messages with &quot;notification&quot; flag</td>
<td>Messages with "notification" flag</td>
<td></td>
<td></td>
</tr>
@@ -1897,8 +1897,8 @@ allow_local_mode = true
<ul>
<li>In the side menu, click the Configuration tab (cog icon)</li>
<li>Click Add data source in the top-right corner of the Data Sources tab</li>
<li>Enter &quot;CSV&quot; in the search box to find the CSV data source</li>
<li>Click the search result that says &quot;CSV&quot;</li>
<li>Enter "CSV" in the search box to find the CSV data source</li>
<li>Click the search result that says "CSV"</li>
<li>In URL, enter a file that points to CSV content</li>
</ul>
<ol start="4">
@@ -1934,7 +1934,7 @@ allow_local_mode = true
<li>
<p><a href="https://github.com/simplex-chat/simplexmq#using-docker">Docker container</a></p>
<ol>
<li>Stop and remove the container:<pre><code class="language-sh">docker rm $(docker stop $(docker ps -a -q --filter ancestor=simplexchat/smp-server --format=&quot;\{\{.ID\}\}&quot;))
<li>Stop and remove the container:<pre><code class="language-sh">docker rm $(docker stop $(docker ps -a -q --filter ancestor=simplexchat/smp-server --format="\{\{.ID\}\}"))
</code></pre>
</li>
<li>Pull latest image:<pre><code class="language-sh">docker pull simplexchat/smp-server:latest
@@ -1968,8 +1968,18 @@ allow_local_mode = true
<p>To configure the app to use your messaging server copy it's full address, including password, and add it to the app. You have an option to use your server together with preset servers or without them - you can remove or disable them.</p>
<p>It is also possible to share the address of your server with your friends by letting them scan QR code from server settings - it will include server password, so they will be able to receive messages via your server as well.</p>
<p><em>Please note</em>: you need SMP server version 4.0 to have password support. If you already have a deployed server, you can add password by adding it to server INI file.</p>
<p><img src="./server_config_1.png" width="288">    <img src="./server_config_2.png" width="288">    <img src="./server_config_3.png" width="288"></p>
</div>
<p><img src="./server_config_1.png" width="288"> &nbsp;&nbsp; <img src="./server_config_2.png" width="288"> &nbsp;&nbsp; <img src="./server_config_3.png" width="288"></p>
<div id="address-portability" class="overlay glossary-overlay hidden"><div class="overlay-card"><h1 class="overlay-title">Address portability</h1><div class="overlay-content"><p>Similarly to <a href="https://en.wikipedia.org/wiki/Local_number_portability">phone number portability</a> (the ability of the customer to transfer the service to another provider without changing the number), the address portability means the ability of a communication service customer to change the service provider without changing the service address. Many <a href="#federated-network">federated networks</a> support SRV records to provide address portability, but allowing service users to set up their own domains for the addresses is not as commonly supported by the available server and client software as for email.</p></div><svg class="close-overlay-btn" id="cross" width="16" height="16" viewBox="0 0 13 13" xmlns="http://www.w3.org/2000/svg"><path d="M12.7973 11.5525L7.59762 6.49833L12.7947 1.44675C13.055 1.19371 13.0658 0.771991 12.8188 0.505331C12.5718 0.238674 12.1602 0.227644 11.8999 0.480681L6.65343 5.58028L1.09979 0.182228C0.805 0.002228 0.430001 0.002228 0.135211 0.182228C-0.159579 0.362228 -0.159579 0.697228 0.135211 0.877228L5.68885 6.27528L0.4918 11.3295C0.231501 11.5825 0.220703 12.0042 0.467664 12.2709C0.714625 12.5376 1.12625 12.5486 1.38655 12.2956L6.63302 7.196L12.1867 12.5941C12.4815 12.7741 12.8565 12.7741 13.1513 12.5941C13.4461 12.4141 13.4461 12.0791 13.1513 11.8991L12.7973 11.5525Z"></path></svg></div></div><div id="federated-network" class="overlay glossary-overlay hidden"><div class="overlay-card"><h1 class="overlay-title">Federated network</h1><div class="overlay-content"><p>Federated network is provided by several entities that agree upon the standards and operate the network collectively. This allows the users to choose their provider, that will hold their account, their messaging history and contacts, and communicate with other providers' servers on behalf of the user. The examples are email, XMPP, Matrix and Mastodon.</p><p>The advantage of that design is that there is no single organization that all users depend on, and the standards are more difficult to change, unless it benefits all users. There are several disadvantages: 1) the innovation is slower, 2) each user account still depends on a single organization, and in most cases can't move to another provider without changing their network address – there is no <a href="#address-portability">address portability</a>, 3) the security and privacy are inevitably worse than with the centralized networks.</p><p><a href="https://en.wikipedia.org/wiki/Federation_(information_technology)">Federation on Wikipedia</a></p></div><svg class="close-overlay-btn" id="cross" width="16" height="16" viewBox="0 0 13 13" xmlns="http://www.w3.org/2000/svg"><path d="M12.7973 11.5525L7.59762 6.49833L12.7947 1.44675C13.055 1.19371 13.0658 0.771991 12.8188 0.505331C12.5718 0.238674 12.1602 0.227644 11.8999 0.480681L6.65343 5.58028L1.09979 0.182228C0.805 0.002228 0.430001 0.002228 0.135211 0.182228C-0.159579 0.362228 -0.159579 0.697228 0.135211 0.877228L5.68885 6.27528L0.4918 11.3295C0.231501 11.5825 0.220703 12.0042 0.467664 12.2709C0.714625 12.5376 1.12625 12.5486 1.38655 12.2956L6.63302 7.196L12.1867 12.5941C12.4815 12.7741 12.8565 12.7741 13.1513 12.5941C13.4461 12.4141 13.4461 12.0791 13.1513 11.8991L12.7973 11.5525Z"></path></svg></div></div><div id="anonymous-credentials" class="overlay glossary-overlay hidden"><div class="overlay-card"><h1 class="overlay-title">Anonymous credentials</h1><div class="overlay-content"><p>The credential that allows proving something, e.g. the right to access some resource, without identifying the user. This credential can either be generated by a trusted party or by the user themselves and provided together with the request to create the resource. The first approach creates some centralized dependency in most cases. The second approach does not require any trust - this is used in SimpleX network to authorize access to the messaging queues.</p><p><a href="https://en.wikipedia.org/wiki/Digital_credential">Digital credential on Wikipedia</a></p></div><svg class="close-overlay-btn" id="cross" width="16" height="16" viewBox="0 0 13 13" xmlns="http://www.w3.org/2000/svg"><path d="M12.7973 11.5525L7.59762 6.49833L12.7947 1.44675C13.055 1.19371 13.0658 0.771991 12.8188 0.505331C12.5718 0.238674 12.1602 0.227644 11.8999 0.480681L6.65343 5.58028L1.09979 0.182228C0.805 0.002228 0.430001 0.002228 0.135211 0.182228C-0.159579 0.362228 -0.159579 0.697228 0.135211 0.877228L5.68885 6.27528L0.4918 11.3295C0.231501 11.5825 0.220703 12.0042 0.467664 12.2709C0.714625 12.5376 1.12625 12.5486 1.38655 12.2956L6.63302 7.196L12.1867 12.5941C12.4815 12.7741 12.8565 12.7741 13.1513 12.5941C13.4461 12.4141 13.4461 12.0791 13.1513 11.8991L12.7973 11.5525Z"></path></svg></div></div><div id="blockchain" class="overlay glossary-overlay hidden"><div class="overlay-card"Line truncated
<li>double ratchet algorithm for <a href="#end-to-end-encryption">end-to-end encryption</a> with <a href="#forward-secrecy">perfect forward secrecy</a> and <a href="#post-compromise-security">post-compromise security</a>,</li>
<li>additional layer of end-to-end encryption for each messaging queue and another encryption layer of encryption from the server to the recipient inside TLS to prevent correlation by ciphertext,</li>
<li>TLS with only strong ciphers allowed,</li>
<li>mitigation of <a href="#man-in-the-middle-attack">man-in-the-middle attack</a> on client-server connection via server offline certificate verification,</li>
<li>mitigation of replay attacks via signing over transport channel binding,</li>
<li>multiple layers of <a href="#message-padding">message padding</a> to reduce efficiency of traffic analysis,</li>
<li>mitigation of <a href="#man-in-the-middle-attack">man-in-the-middle attack</a> on client-client out-of-band channel when sending the invitation,</li>
<li>rotation of delivery queues to reduce efficiency of traffic analysis,</li>
<li>etc.</li>
</ul><p><a href="https://en.wikipedia.org/wiki/Defence_in_depth">Wikipedia</a></p></div><svg class="close-overlay-btn" id="cross" width="16" height="16" viewBox="0 0 13 13" xmlns="http://www.w3.org/2000/svg"><path d="M12.7973 11.5525L7.59762 6.49833L12.7947 1.44675C13.055 1.19371 13.0658 0.771991 12.8188 0.505331C12.5718 0.238674 12.1602 0.227644 11.8999 0.480681L6.65343 5.58028L1.09979 0.182228C0.805 0.002228 0.430001 0.002228 0.135211 0.182228C-0.159579 0.362228 -0.159579 0.697228 0.135211 0.877228L5.68885 6.27528L0.4918 11.3295C0.231501 11.5825 0.220703 12.0042 0.467664 12.2709C0.714625 12.5376 1.12625 12.5486 1.38655 12.2956L6.63302 7.196L12.1867 12.5941C12.4815 12.7741 12.8565 12.7741 13.1513 12.5941C13.4461 12.4141 13.4461 12.0791 13.1513 11.8991L12.7973 11.5525Z"></path></svg></div></div><div id="end-to-end-encryption" class="overlay glossary-overlay hidden"><div class="overlay-card"><h1 class="overlay-title">End-to-end encryption</h1><div class="overlay-content"><p>A communication system where only the communicating parties can read the messages. It is designed to protect message content from any potential eavesdroppers – telecom and Internet providers, malicious actors, and also the provider of the communication service.</p><p>End-to-end encryption requires agreeing cryptographic keys between the sender and the recipient in a way that no eavesdroppers can access the agreed keys. See <a href="#key-agreement-protocol">key agreement protocol</a>. This key exchange can be compromised via <a href="#man-in-the-middle-attack">man-in-the-middle attack</a>, particularly if key exchange happens via the same communication provider and no out-of-band channel is used to verify key exchange.</p><p><a href="https://en.wikipedia.org/wiki/End-to-end_encryption">Wikipedia</a></p></div><svg class="close-overlay-btn" id="cross" width="16" height="16" viewBox="0 0 13 13" xmlns="http://www.w3.org/2000/svg"><path d="M12.7973 11.5525L7.59762 6.49833L12.7947 1.44675C13.055 1.19371 13.0658 0.771991 12.8188 0.505331C12.5718 0.238674 12.1602 0.227644 11.8999 0.480681L6.65343 5.58028L1.09979 0.182228C0.805 0.002228 0.430001 0.002228 0.135211 0.182228C-0.159579 0.362228 -0.159579 0.697228 0.135211 0.877228L5.68885 6.27528L0.4918 11.3295C0.231501 11.5825 0.220703 12.0042 0.467664 12.2709C0.714625 12.5376 1.12625 12.5486 1.38655 12.2956L6.63302 7.196L12.1867 12.5941C12.4815 12.7741 12.8565 12.7741 13.1513 12.5941C13.4461 12.4141 13.4461 12.0791 13.1513 11.8991L12.7973 11.5525Z"></path></svg></div></div><div id="forward-secrecy" class="overlay glossary-overlay hidden"><div class="overlay-card"><h1 class="overlay-title">Forward secrecy</h1><div class="overlay-content"><p>Also known as perfect forward secrecy, it is a feature of a <a href="#key-agreement-protocol">key agreement protocol</a> that ensures that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised. Forward secrecy protects past sessions against future compromises of session or long-term keys.</p><p><a href="https://en.wikipedia.org/wiki/Forward_secrecy">Wikipedia</a></p></div><svg class="close-overlay-btn" id="cross" width="16" height="16" viewBox="0 0 13 13" xmlns="http://www.w3.org/2000/svg"><path d="M12.7973 11.5525L7.59762 6.49833L12.7947 1.44675C13.055 1.19371 13.0658 0.771991 12.8188 0.505331C12.5718 0.238674 12.1602 0.227644 11.8999 0.480681L6.65343 5.58028L1.09979 0.182228C0.805 0.002228 0.430001 0.002228 0.135211 0.182228C-0.159579 0.362228 -0.159579 0.697228 0.135211 0.877228L5.68885 6.27528L0.4918 11.3295C0.231501 11.5825 0.220703 12.0042 0.467664 12.2709C0.714625 12.5376 1.12625 12.5486 1.38655 12.2956L6.63302 7.196L12.1867 12.5941C12.4815 12.7741 12.8565 12.7741 13.1513 12.5941C13.4461 12.4141 13.4461 12.0791 13.1513 11.8991L12.7973 11.5525Z"></path></svg></div></div><div id="post-compromise-security" class="overlay glossary-overlay hidden"><div class="overlay-card"><h1 class="overlay-title">Post-compromise security</h1><div class="overlay-content"><p>Also known as break-in recovery, it is the quality of the end-to-end encryption scheme allowing to recover security against a passive attacker who observes encrypted messages after compromising one (or both) of the parties. Also known as recovery from compromise or break-in recovery. <a href="#double-ratchet-algorithm">Double-ratchet algorithm</a> has this quality.</p></div><svg class="close-overlay-btn" id="cross" width="16" height="16" viewBox="0 0 13 13" xmlns="http://www.w3.org/2000/svg"><path d="M12.7973 11.5525L7.59762 6.49833L12.7947 1.44675C13.055 1.19371 13.0658 0.771991 12.8188 0.505331C12.5718 0.238674 12.1602 0.227644 11.8999 0.480681L6.65343 5.58028L1.09979 0.182228C0.805 0.002228 0.430001 0.002228 0.135211 0.182228C-0.159579 0.362228 -0.159579 0.697228 0.135211 0.877228L5.68885 6.27528L0.4918 11.3295C0.231501 11.5825 0.220703 12.0042 0.467664 12.2709C0.714625 12.5376 1.12625 12.5486 1.38655 12.2956L6.63302 7.196L12.1867 12.5941C12.4815Line truncated
</article>
</main>
</div>
@@ -2099,6 +2109,7 @@ allow_local_mode = true
<script src="/js/docs.js"></script>
<script src="/js/script.js"></script>
<script src="/js/prism.min.js"></script>
</body>