9 ms·
MTProto, the symmetric encryption scheme used in Telegram, is not IND-CCA secure
- delan 11y agoThis article is based on Jakobsen’s master’s thesis: https://news.ycombinator.com/item?id=10713064 https://news.ycombinator.com/item?id=10713064
- HappyTypist 11y agoWhat a surprise, not. Many respected experts have criticised Telegram for implementing their own cryptography and using meaningless buzzwords, while also making encryption opt in. Telegram is clearly not a privacy-motivated platform and anyone who thinks so is deluding themselves. Even the closed source WhatsApp (uses ETE from the Signal guys) and iMessage are arguably less likely to contain cryptographic flaws than Telegram.
- chinathrow 11y agoI can't find any official statements by WA/FB that WhatsApp uses ETE. Do you have further sources aside from [1]? [1] http://www.wired.com/2014/11/whatsapp-encrypted-messaging/ http://www.wired.com/2014/11/whatsapp-encrypted-messaging/
- eggie 11y agoWhy would they use ETE? Isn't the whole point of WA/FB to sell user-created data to third parties? Edit: Given the down vote(s), I guess I'm missing something obvious. What I'm getting at is this: If our activities were completely encrypted and we appeared anonymous to WA/FB they couldn't hope to make money. Would anyone smarter than me care to explain why this isn't the case?
- eliteraspberrie 11y agoIt's a good question. But I think the contents of their users' communications are less important for their revenues than the metadata.
- eggie 11y agoIs there a description of this somewhere? (Such as in public filings.) Is the advertising so coarse as to ignore the content of what people say? Are they only propagating information about purchasing and browsing history through the metadata offered by the social network information in order to drive advertising? All the questions should suggest that I'm genuinely curious and looking to understand, so if you read this and get riled up, instead of downvoting please take twenty seconds to guide me to the truth...
- newscracker 11y ago> Even the closed source WhatsApp (uses ETE from the Signal guys) and iMessage are arguably less likely to contain cryptographic flaws than Telegram Even though you used the words "arguably less likely" to soften your statement, there's no way to check what WhatsApp or iMessage are doing because they're not open source. So even if security researchers want to look at the code or build their own clients, it's not possible. Reverse engineering is possible, but is tedious compared to having the source code. At least the Telegram client code is open source to support examining it. That said, the criticism of Telegram for using home brewed encryption is appropriate and needs to be mentioned often (hopefully Telegram will change the protocol). Even the authors of this paper state: > The take-home message (once again) is that well-studied, provably secure encryption schemes that achieve strong definitions of security (e.g., authenticated-encryption) are to be preferred to home-brewed encryption schemes.
- tptacek 11y agoThere's "no way" to check what iMessage is doing?
- cpach 11y agoI guess it’s possible on a jailbroken device. (Perhaps even on a non-jailbroken device…?)
- chowells 11y agoAll you need is to capture and view the traffic at the network level. You can easily do that off-device when using wifi.
- askmike 11y agoThat way you can't know for sure what is happening all the times you aren't watching (maybe the client is coded with "use shitty encryption [when client receives message X from server / the year is 2016 / your message includes a word on a blacklist]"). In theory you could reverse engineer the binary (which is compiled code), this is how security firms try to understand malware (like stuxnet). But this is pretty hard to do.
- huskyr 11y agoI'm saddened by this. I'm a heavy user of Telegram, and i think it's in many respects superior to WhatsApp and iMessage. The weird stance on cryptography is such a shame.
- newjersey 11y agoPlease consider switching your team over to Signal. Or at least give it a try if you are on an iOS or an Android phone.
- nicolapede 11y agoAny suggestion for Windows Phone 8 users?
- newjersey 11y agoHow recent is your device? Is it scheduled to get Windows 10? I'd say our best bet at this time is to push for a Universal Windows Platform app. How good is your C#?
- nicolapede 11y agoI think quite good although I haven't tried to write anything in Universal Windows Platform yet. Sorry for the late reply.
- eliteraspberrie 11y agoWhatsApp encryption is broken. WhatsApp can just turn off encryption when they want, without users knowing: http://heise.de/-2630361 http://heise.de/-2630361 That's probably what happened in June: "Investigators said earlier they had detained 16 people in the anti-terror raids after working with U.S. authorities to monitor suspects' communications on WhatsApp Inc.'s messaging service." http://www.bloomberg.com/news/articles/2015-06-08/belgium-arrests-16-in-terror-raid-triggered-by-whatsapp-messages http://www.bloomberg.com/news/articles/2015-06-08/belgium-ar...
- paulmillr 11y agoIt's fair to say that this is still a theoretical attack. As authors of this paper mentioned, they don't see a way of turning the "flaw" into a real exploit.
- dnlrn 11y agoWell, a theoretical attack is worse than no theoretical attack. Especially if there are perfectly fine protocols available that are IND-CCA2 secure.
- tptacek 11y agoIt's not a theoretical attack. https://news.ycombinator.com/item?id=10713064 https://news.ycombinator.com/item?id=10713064
- illumen 11y agoThe article says: "We stress that this is a theoretical attack on the definition of security and we do not see any way of turning the attack into a full plaintext-recovery attack." ... which appears wrong, and even published after the other paper?
- detaro 11y agoAnd the article linked by tptacek (by the same authors) builds on this and shows practical attacks.
- sdevlin 11y agoTheoretical attacks have a way of turning into weaponized exploits. For example, check out https://www.openssl.org/~bodo/tls-cbc.txt https://www.openssl.org/~bodo/tls-cbc.txt. This is a document published by Bodo Moeller in the early 2000s that details multiple theoretical weaknesses in the CBC mode used in TLS. Read it top to bottom and see how many practical attacks on TLS you can count.
- tptacek 11y ago
- jessaustin 11y agoAccording to the official description of MTProto the padding length is between 0 and 120 bits, which means that in the best case scenario the above attack succeeds with probability 2⁻⁸. However experimental validation shows that this is not the case and the length of the padding is in fact between 0 and 96 bits (this is due to the way the objects are serialized in Java). So we conclude that in the best case this attack succeeds with probability 2⁻³²... With a bit more knowledge about Java object serialization, could one be a bit more clever about picking the random block?
- deleted 11y ago[deleted]
- zanny 11y agoSomeone is going to write a book about how backwards and stupid person to person communications were from the year 1990 to the year 2020 at the earliest. We have all these proprietary awful protocols meant to lock you into an app or a platform, and threw away standards years ago. We "trust" proprietary services with security while ignoring the existence of decades old proven open secure communications like OTR, mainly because the proprietary vendors want to shove their crap down everyones throat to be able to read all their communications, or in telegrams case profit off buzzword security rather than real security. And the joke is it is working fantastically. Someone wrote a non-fiction novel on doublethink and were the setting.
- Canada 11y ago> proven open secure communications like OTR Axolotl has significant advantages over OTR, such as forward secrecy and deniability while operating in an asynchronous context. It is necessary that the global standard for secure messaging be decided by rough consensus and running code and not by standards committee.
- tptacek 11y agoFor those wondering: IND refers to "indistinguishability"; it is the property of not being able to pick a matching plaintext/ciphertext pair out of a lineup of ciphertexts. CCA stands for Chosen Ciphertext Attacks, and refers to the class of attacks where the cryptanalyst alters ("chooses") the ciphertext before it's decrypted by the victim, and is then able to learn things from the victim's behavior. (There's also CCA2, in which the attacker gets feedback from the victim on a single piece of ciphertext, over and over again.) TLS's Mac-then-encrypt CBC was known not to be IND-CCA secure, and a few years later Thai Duong and Juliano Rizzo turned that property into BEAST. Then there was CRIME, then Lucky13, and finally TLS MtE CBC had to be put to sleep. The easiest way to lose IND-CCA security is to fail to MAC your ciphertext. This is such a common flaw that Moxie Marlinspike, a co-author of TextSecure/Signal, which you should use in preference to Telegram, named it "the cryptographic doom principle". This paper is a building block for a much more significant attack, which is the author's masters thesis: https://news.ycombinator.com/item?id=10713064 https://news.ycombinator.com/item?id=10713064
- AnthonyMouse 11y ago> This is such a common flaw that Moxie Marlinspike, a co-author of TextSecure/Signal, which you should use in preference to Telegram, named it "the cryptographic doom principle". He also wrote a good post explaining it: http://www.thoughtcrime.org/blog/the-cryptographic-doom-principle/ http://www.thoughtcrime.org/blog/the-cryptographic-doom-prin...
- dalanmiller 11y agoDoes this only affect the standard Telegram chats or also "Secret Chats" as well?
- tptacek 11y agoMy understanding is that the "secret chats" (which should be, but aren't, the default) use the same bulk encryption construction.
- wladston 11y agoFor those who are not crypto experts, how would an attack exploiting an IND-CCA vulnerability work, in lay terms? Also, what kind of information one could learn from the victim's behaviour?
- sirnicolaz 11y agoI still don't really understand this all discussion around Telegram. MTProto is used just with the regular chats and they decided to use a custom protocol "In order to achieve reliability on weak mobile connections as well as speed when dealing with large files (such as photos, large videos and files up to 1,5 GB)" (from the FAQ). There is also a pretty long discussion here http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac... between Telegram developers and another "security expert", where the practical reasons for their choices are explained (might be outdated, but it's still interesting to see why certain more secure algorithms might not be always the best solution). Providing cloud services, robustness and reliability can come at a cost unfortunately. If you care about having a really private conversation, just instantiate the Secret Chat. It's state of the art in terms of security. Just one of the many benchmarks https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard.
- tptacek 11y agoI don't think it's true that the "secret chats" don't use MTE IGE; I think the "secret chats" are the same construction, but keyed with a separate DH handshake.
- xnyhps 11y agoBut it still asks the server to pick the group in which to do DH. This has to be exploitable somehow...
- tptacek 11y agoI agree that's a very dumb design decision, but supposedly the clients are expected to validate the DH parameters.
- xnyhps 11y agoTrue, it needs to be a safe prime, but not all 2048-bit safe primes are equally good. At the very least there are those for which the Special Number Field Sieve applies, though that's likely still infeasible. There might be very rare 2048-bit DH groups using safe primes for which the DLP problem is easily solvable, I wasn't able to find any research into whether or not those can exist.
- sarciszewski 11y agoDespite the severity of this finding, it still doesn't qualify for the empty "break our crypto" contest that Telegram put out. STOP USING TELEGRAM!
- snuxoll 11y agoGood, MTProto is a giant PITA anyway. Why they felt the need to roll their own crypto is beyond me, and I really wish people would stop doing so because inevitably it ends up broken.
- ex3ndr 11y agoFull disclosure: Worked at Telegram That's why, we after quitting Telegram and starting to build Actor we decided not to implement theirs encryption because it always looks like spagetti-encryption.