5 ms·

I'm curious about what they call "enhanced AES-GCM encryption". Because to me that smells like "roll your own crypto" kind of deal, where "moar perf" quickly en

I'm curious about what they call "enhanced AES-GCM encryption". Because to me that smells like "roll your own crypto" kind of deal, where "moar perf" quickly ends up being "moar sidechannels" (whether willingly or not). It does sound very intriguing to me at least.

jhardy54 6y ago
I'm also very curious about this. AES-GCM satisfies my threat model, "enhanced" does not.
- blakesterz 6y ago
  I'm curious about your threat model, only because this doesn't concern me much. Why does this not satisfy yours, I'm afraid I'm a missing something.
  - TrainedMonkey 6y ago
    I believe parent infers that 'enhanced' means they modified crypto stack and broke prime directive: "Never roll your own crypto".
  - jhardy54 6y ago
    The word 'enhanced' in the context of cryptography just means 'modified', and modifications to security-critical algorithms are considered unsafe unless proven safe. AES-GCM refers to a specific set of trade-offs. How do those trade-offs differ with the changes that Zoom has made?
- fsflover 6y ago
  Not sure how a closed code can satisfy a threat model depending on the encryption details. If you trust the company to implement AES-GCM in secrecy, why not also trust with the "enhanced" part?
  - Rebelgecko 6y ago
    If they say they're using regular AES-GCM from a library that's been decently vetted, the main things you have to worry about are 1. intentional backdoors 2. someone using the library improperly (like using the same IV for every encryption) If they're rolling their own encryption library, you have to worry about 1. intentional backdoors 2. someone using the library improperly 3. the quality of their implementation of crypto primitives Getting #2 right is definitely doable for a typical programmer who takes a little time to understand the basic dos and donts. IMO #3 is not doable for a typical programmer, and certainly isn't trivial even for people that are experts (at least for a relatively complicated pair of algorithms like AES and GCM). So even though #3 is just one more thing that can go wrong, it's way more likely to be a problem than #2
    - dylan604 6y ago
      >1. intentional backdoors With all of the previously disclosed security fiascos of Zoom decisions, this would be my concern. Whether it was for debugging purposes later, it just makes something down the road easier, or it was done to satisfy an external request. I do not trust Zoom to get this right
      - searchableguy 6y ago
        They acquihired keybase a while ago: https://keybase.io/blog/keybase-joins-zoom https://keybase.io/blog/keybase-joins-zoom
        Corrado 6y ago
        Yes, and that makes me sad every time I think about it. Keybase had such potential to change privacy/encryption but just couldn't make it work financially.
- barkingcat 6y ago
  Saying something "satisfies your threat model" is pretty foolhardy unless you can read Zoom's source code and implementation of this standard.
  - Threeve303 6y ago
    It sounds good though
  - deleted 6y ago
    [deleted]
iancarroll 6y ago
What was published not too long ago: https://github.com/zoom/zoom-e2e-whitepaper https://github.com/zoom/zoom-e2e-whitepaper
secalex 6y ago
In both the "normal" case and in situations where end-to-end encryption is enabled, the audio and visual streams are individually encrypted with AES-GCM-256 using a key derived from a shared per-meeting key. The difference is that in the normal case, the per-meeting key is stable for the entire meeting and is available to Zoom (as is needed for POTS bridge, cloud recordings, etc...). When the meeting is E2EE, the key is generated by the host, distributed to the other attendees, and rotated as the meeting participants change. Details: https://github.com/zoom/zoom-e2e-whitepaper/blob/master/zoom_e2e.pdf https://github.com/zoom/zoom-e2e-whitepaper/blob/master/zoom...
- beaner 6y ago
  If the key is available to Zoom, what's the point?
  - kelnos 6y ago
    Not sure why you're being downvoted, as I'm curious about that as well. Your parent's description of the protocol makes it seem like the meeting host generates a key and sends it to Zoom so Zoom can send the key to the participants. I skimmed the whitepaper, though, and it seems what actually happens is the clients generate their own public/private keypairs, which allows the clients to negotiate session keys without exposing the keys to Zoom's server. Of course since the client code is closed source, you just have to trust that it isn't sharing the session keys with Zoom or a third party. That's the same potential flaw as with something like WhatsApp's, Telegram's, or FB Messenger's E2EE mode: the app itself can intentionally break the security of the system, and you probably won't know it.
    - pokoleo 6y ago
      Agreed with the parent. Even if the above is true, what's to prevent Zoom from creating a quiet/phantom "extra participant" and never having the client UI tell you about it.
      - VWWHFSfQ 6y ago
cataflam 6y ago
I clearly read it as enhanced compared to the previous versions, which used to be AES-ECB until earlier this year. Note how it mentions "How is this different from Zoom’s enhanced GCM encryption?", which means enhanced also applies to the normal Zoom meetings which are encrypted but not E2E, and supports this interpretation.
- noodlesUK 6y ago
  I think this is probably the intended meaning, but it’s best not to be too generous when it comes to questionable things people say about their security.
hatsunearu 6y ago
Yeah symmetric ciphers are easy (TM), it's the pub key shit that really gets you.
aussieguy1234 6y ago
Zoom's development team is based in China [1]. Could the government there force these devs to "enhance" this encryption with a backdoor or two for "state security" reasons? [1] https://www.forbes.com/sites/thomasbrewster/2020/04/03/warning-zoom-sends-encryption-keys-to-china-sometimes/#3a871b153fd9 https://www.forbes.com/sites/thomasbrewster/2020/04/03/warni...
- R0b0t1 6y ago
  Yes, but more likely they'd have someone be hired surreptitiously before forcing anything.
- inquirerofsorts 6y ago
  Of course they could. Just like they can in Australia. We've already got plans for large tech companies to have "embedded" federal agents in their buildings.
yumraj 6y ago
Perhaps enhanced means backdoor-ed.
noodlesUK 6y ago
AES-GCM has serious problems with nonce reuse when you have encrypted a lot of data. As I recall, solving that problem was part of the CESAR competition a couple years back.
- aneutron 6y ago
  Huh, didn't know about this. Can you please give me your source on this ? Should be a fun read.

jhardy54 6y ago

I'm also very curious about this. AES-GCM satisfies my threat model, "enhanced" does not.

blakesterz 6y ago
I'm curious about your threat model, only because this doesn't concern me much. Why does this not satisfy yours, I'm afraid I'm a missing something.
- TrainedMonkey 6y ago
  I believe parent infers that 'enhanced' means they modified crypto stack and broke prime directive: "Never roll your own crypto".
- jhardy54 6y ago
  The word 'enhanced' in the context of cryptography just means 'modified', and modifications to security-critical algorithms are considered unsafe unless proven safe. AES-GCM refers to a specific set of trade-offs. How do those trade-offs differ with the changes that Zoom has made?
fsflover 6y ago
Not sure how a closed code can satisfy a threat model depending on the encryption details. If you trust the company to implement AES-GCM in secrecy, why not also trust with the "enhanced" part?
- Rebelgecko 6y ago
  If they say they're using regular AES-GCM from a library that's been decently vetted, the main things you have to worry about are 1. intentional backdoors 2. someone using the library improperly (like using the same IV for every encryption) If they're rolling their own encryption library, you have to worry about 1. intentional backdoors 2. someone using the library improperly 3. the quality of their implementation of crypto primitives Getting #2 right is definitely doable for a typical programmer who takes a little time to understand the basic dos and donts. IMO #3 is not doable for a typical programmer, and certainly isn't trivial even for people that are experts (at least for a relatively complicated pair of algorithms like AES and GCM). So even though #3 is just one more thing that can go wrong, it's way more likely to be a problem than #2
  - dylan604 6y ago
    >1. intentional backdoors With all of the previously disclosed security fiascos of Zoom decisions, this would be my concern. Whether it was for debugging purposes later, it just makes something down the road easier, or it was done to satisfy an external request. I do not trust Zoom to get this right
    - searchableguy 6y ago
      They acquihired keybase a while ago: https://keybase.io/blog/keybase-joins-zoom https://keybase.io/blog/keybase-joins-zoom
      - Corrado 6y ago
        Yes, and that makes me sad every time I think about it. Keybase had such potential to change privacy/encryption but just couldn't make it work financially.
barkingcat 6y ago
Saying something "satisfies your threat model" is pretty foolhardy unless you can read Zoom's source code and implementation of this standard.
- Threeve303 6y ago
  It sounds good though
- deleted 6y ago
  [deleted]

iancarroll 6y ago

What was published not too long ago: https://github.com/zoom/zoom-e2e-whitepaper https://github.com/zoom/zoom-e2e-whitepaper

secalex 6y ago

In both the "normal" case and in situations where end-to-end encryption is enabled, the audio and visual streams are individually encrypted with AES-GCM-256 using a key derived from a shared per-meeting key. The difference is that in the normal case, the per-meeting key is stable for the entire meeting and is available to Zoom (as is needed for POTS bridge, cloud recordings, etc...). When the meeting is E2EE, the key is generated by the host, distributed to the other attendees, and rotated as the meeting participants change. Details: https://github.com/zoom/zoom-e2e-whitepaper/blob/master/zoom_e2e.pdf https://github.com/zoom/zoom-e2e-whitepaper/blob/master/zoom...

beaner 6y ago
If the key is available to Zoom, what's the point?
- kelnos 6y ago
  Not sure why you're being downvoted, as I'm curious about that as well. Your parent's description of the protocol makes it seem like the meeting host generates a key and sends it to Zoom so Zoom can send the key to the participants. I skimmed the whitepaper, though, and it seems what actually happens is the clients generate their own public/private keypairs, which allows the clients to negotiate session keys without exposing the keys to Zoom's server. Of course since the client code is closed source, you just have to trust that it isn't sharing the session keys with Zoom or a third party. That's the same potential flaw as with something like WhatsApp's, Telegram's, or FB Messenger's E2EE mode: the app itself can intentionally break the security of the system, and you probably won't know it.
  - pokoleo 6y ago
    Agreed with the parent. Even if the above is true, what's to prevent Zoom from creating a quiet/phantom "extra participant" and never having the client UI tell you about it.
    - VWWHFSfQ 6y ago

cataflam 6y ago

I clearly read it as enhanced compared to the previous versions, which used to be AES-ECB until earlier this year. Note how it mentions "How is this different from Zoom’s enhanced GCM encryption?", which means enhanced also applies to the normal Zoom meetings which are encrypted but not E2E, and supports this interpretation.

noodlesUK 6y ago
I think this is probably the intended meaning, but it’s best not to be too generous when it comes to questionable things people say about their security.

hatsunearu 6y ago

Yeah symmetric ciphers are easy (TM), it's the pub key shit that really gets you.

aussieguy1234 6y ago

Zoom's development team is based in China [1]. Could the government there force these devs to "enhance" this encryption with a backdoor or two for "state security" reasons? [1] https://www.forbes.com/sites/thomasbrewster/2020/04/03/warning-zoom-sends-encryption-keys-to-china-sometimes/#3a871b153fd9 https://www.forbes.com/sites/thomasbrewster/2020/04/03/warni...

R0b0t1 6y ago
Yes, but more likely they'd have someone be hired surreptitiously before forcing anything.
inquirerofsorts 6y ago
Of course they could. Just like they can in Australia. We've already got plans for large tech companies to have "embedded" federal agents in their buildings.

yumraj 6y ago

Perhaps enhanced means backdoor-ed.

noodlesUK 6y ago

AES-GCM has serious problems with nonce reuse when you have encrypted a lot of data. As I recall, solving that problem was part of the CESAR competition a couple years back.

aneutron 6y ago
Huh, didn't know about this. Can you please give me your source on this ? Should be a fun read.