3 ms·
I still don't really understand this all discussion around Telegram. MTProto is used just with the regular chats and they decided to use a custom protocol "In o
by sirnicolaz 11y ago
I still don't really understand this all discussion around Telegram. MTProto is used just with the regular chats and they decided to use a custom protocol "In order to achieve reliability on weak mobile connections as well as speed when dealing with large files (such as photos, large videos and files up to 1,5 GB)" (from the FAQ). There is also a pretty long discussion here http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac... between Telegram developers and another "security expert", where the practical reasons for their choices are explained (might be outdated, but it's still interesting to see why certain more secure algorithms might not be always the best solution). Providing cloud services, robustness and reliability can come at a cost unfortunately.
If you care about having a really private conversation, just instantiate the Secret Chat. It's state of the art in terms of security. Just one of the many benchmarks https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard.
- tptacek 11y agoI don't think it's true that the "secret chats" don't use MTE IGE; I think the "secret chats" are the same construction, but keyed with a separate DH handshake.
- xnyhps 11y agoBut it still asks the server to pick the group in which to do DH. This has to be exploitable somehow...
- tptacek 11y agoI agree that's a very dumb design decision, but supposedly the clients are expected to validate the DH parameters.
- xnyhps 11y agoTrue, it needs to be a safe prime, but not all 2048-bit safe primes are equally good. At the very least there are those for which the Special Number Field Sieve applies, though that's likely still infeasible. There might be very rare 2048-bit DH groups using safe primes for which the DLP problem is easily solvable, I wasn't able to find any research into whether or not those can exist.
- tptacek 11y agoYou also have to validate the generator, which is trickier than the prime.