Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is anyone aware of an analysis of the TextSecure protocol?

It is a simplification of the OTR protocol. Instead of signing the ephemeral key, it uses DH over an ephemeral key (a,b) and an identity (A,B) key.

The claimed advantages are: Reduced Algorithmic Complexity, Increased Forgability, Reduced Protocol Complexity, Maintained Forward Secrecy, and Smaller Payloads

Textsecure initialization scheme

share|improve this question
I am not aware of any analysis of the protocol. Note that the protocols described in your two links aren't the same: one is for the current TextSecure application, while the other will be used for the upcoming iOS TextSecure client. – user34390 Nov 19 '13 at 6:13
Didn't Bruce Schneier once say that it's mathematically solid, and that if there is a flaw in it then it's in the implementation? Or was that about otr, I don't remember... – Luc May 4 '14 at 15:10
related: create an email plugin that uses Textsecures Axolotl protocol:… – rubo77 Mar 6 '15 at 14:37

Not an cryptographer and haven't analysed it in-depth, but from my brief inspection:

The Secure Text protocol 1 (as specified in the wiki) works with (initial) ephemeral ECC Keys, that requires validation of the key exchange on each session initiation. The tool provided for this is pretty ugly (comparing two SHA-1 fingerprints). I think this needs to be improved.

There is also no protocol feature to reveal the HMAC Keys so an longer one-way conversation cannot be invalidated (if for example both devices are inspected and the current keys are retrieved). But that disadvantage is I guess mitigated by a better denyability due to the random keys (as long as applications do not build a persistence around it).

But Text Secure already work on a new protocol which is specified here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.