Future work: forward secrecy

[paulmillr]

• We can implement a solution without prekeys, where sender mixes in her ephemeral only if no ephemeral key of the receiver is known (no prekey, and no prior communication).
• Once the receiver replies, he includes a public ephemeral key for later use.
• It then takes a bit longer (until receiver replies) to achieve full forward secrecy. This is similar to protocols such as OTR or Threema.
• One potential malleability point could be the difference in serialization of events between implementations.