3 ms·
Apart from choosing RSA over elliptical curves, which primitive in particular is the problem? Otherwise under the hood it's AES256-IGE and SHA256? The key exch
by BelenusMordred 6y ago
Apart from choosing RSA over elliptical curves, which primitive in particular is the problem? Otherwise under the hood it's AES256-IGE and SHA256?
The key exchange is a strange choice for a modern greenfields project but hardly that noteworthy.
- amluto 6y agoAs far as I can tell, AES256-IGE is a made up mode used only by Telegram. That’s far from being a standard choice. I don’t know what authenticated encryption scheme they build on it, but on a very brief look, it doesn’t look authenticated at all. See: https://mgp25.com/AESIGE/ https://mgp25.com/AESIGE/
- deleted 6y ago[deleted]
- BelenusMordred 6y ago> made up mode It's was implemented in OpenSSL 15 years ago. https://github.com/openssl/openssl/blob/master/crypto/aes/aes_ige.c https://github.com/openssl/openssl/blob/master/crypto/aes/ae...
- ex3ndr 6y agoAES256-IGE is a good choice since it disappeared from papers and suspected to be superior than other modes. Papers are literally disappeared in first month of public Telegram release. Source: Myself working at first months after public Telegram release on Android client.
- amluto 6y agoHow is disappearance from papers a good thing? I found a patent (!): https://patents.google.com/patent/US6973187B2/en https://patents.google.com/patent/US6973187B2/en It’s written in patent-ese, but it looks like a mediocre attempt at an efficient authenticated encryption scheme, and it doesn’t appear to use the building blocks of modern schemes. I can’t even find a coherent description of what the “non-cryptographic manipulation detection code” is or what properties are required. Meanwhile, the Telegram protocol is new. Surely it should use a standard AEAD with a security proof.