The proposal for forward secrecy in the spec (https://darkmail.info/downloads/dark-internet-mail-environment-december-2014.pdf https://darkmail.info/downloads/d

The proposal for forward secrecy in the spec (https://darkmail.info/downloads/dark-internet-mail-environment-december-2014.pdf https://darkmail.info/downloads/dark-internet-mail-environme...) is not great and does not reflect the current state of the art: > PFS for message objects, as the description above suggests, is far more difficult, and contrary to the nature of email. It recommends just rotating public keys every few days with a paranoid mode. A much better solution is to implement the Axolotl Ratchet pioneered by Open Whisper Systems for TechSecure: https://www.whispersystems.org/blog/advanced-ratcheting/ https://www.whispersystems.org/blog/advanced-ratcheting/ https://github.com/trevp/axolotl/wiki https://github.com/trevp/axolotl/wiki With Axolotl Ratchet, you get: * forward secrecy - disclosure of private keys doesn't let an attacker in the future go back and read encrypted communication * future secrecy - disclosure of ephemeral private keys doesn't disclose (much) future content I also get the feeling from a glance reading the spec that way too much trust is being placed on service providers. That there is even such a category as "trustful" where the server has access to your private keys is a huge red flag and that was exactly the problem with lavabit: http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/