Just to clarify, the attack you want to protect against is that of an adversary being able to conclude the DH public key exchange with a bona fide weave peer, despite having no knowledge of the password. Correct? But…
I don't think that feature ever existed. Though a representation in a particular character set does not prevent the password from being strong.
> All of the privacy and integrity you could produce with the system described is what comes from the password. That is correct. I guess calling this a 'password' is perhaps misleading in our docs, since it could be…
> "they do not use a password hashing function" From the weave crypto docs at http://weaveworks.github.io/weave/how-it-works.html#crypto: "The public key from the remote peer is combined with the private key for the…
Just to clarify, the attack you want to protect against is that of an adversary being able to conclude the DH public key exchange with a bona fide weave peer, despite having no knowledge of the password. Correct? But…
I don't think that feature ever existed. Though a representation in a particular character set does not prevent the password from being strong.
> All of the privacy and integrity you could produce with the system described is what comes from the password. That is correct. I guess calling this a 'password' is perhaps misleading in our docs, since it could be…
> "they do not use a password hashing function" From the weave crypto docs at http://weaveworks.github.io/weave/how-it-works.html#crypto: "The public key from the remote peer is combined with the private key for the…