init

sections/conclusion.tex

@@ -0,0 +1,11 @@
+We have presented a formal description of the nested ratchet protocol, instantiated with representative designs used in practice 
+such as Sender Keys and Megolm, as well as the first
+unified, mechanized cryptographic analysis.
+Our results demonstrate that core guarantees, including
+secrecy, mutual authentication, perfect forward secrecy, 
+and post-compromise security, hold under standard assumptions.
+We also present the first mechanized treatment of offline deniability 
+for this class of protocols. 
+We provide a detailed analysis of the compromise scenarios across pairwise and fan-out layers, clarifying how failures propagate and when recovery occurs (e.g. upon session regeneration or double ratchet-based self-healing).
+
+Our analysis and formal models underscore two key design choices when constructing and implementing a nested ratchet protocol: (1) the deniability and trust implications of signed vs. unsigned pre-keys, and (2) the trade-off between non-reputation and deniability when choosing signatures vs. MACs for fan-out. Based on the tradeoffs we identity, as well as our formal analysis, we provide additional concrete recommendations for protocol implementers. Ultimately, in addition to the concrete results our analysis provides, our work demonstrates the utility of formal methods and computer-aided reasoning for constructing and verifying secure protocols.