5 ms·

Because the app constantly prompts for contact-list access, Signal's software-on-device definitely has the contact list. And, that software regularly re-sends

by gojomo 5y ago

Because the app constantly prompts for contact-list access, Signal's software-on-device definitely has the contact list. And, that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol. So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that deliver/update the Signal software on-device.)

tptacek 5y ago
I haven't kept up with what they're doing so grain of salt on this, but I think this is incorrect. What they're moving towards is a design that looks like what Apple did with their HSM quorum system. The contact information we're talking about is encrypted clientside, but with (usually) a memorable pin. Without countermeasures, memorable PINs are very easy to attack; SGX allows them to artificially limit guesses. As a user, you retain a security dial on this: you can use a more complicated passcode than a 4-digit pin if you don't trust SGX. Obtaining the whole database Signal maintains gives you ciphertext that you need to mount attacks on user-by-user (and to make those attacks, you'd have to break SGX). It doesn't simply give you the plaintext SQL database other messaging systems collect.
- gojomo 5y ago
  Yes, if you "break SGX", Signal's contact-intersection-privacy guarantees fall. Are you confident that SGX is unbroken?
- stavros 5y ago
  AFAIK they don't encrypt the contact list, they hash each number and send a few bits of the hash to the server. The server replies with a few possible hashes it knows about, so the client can reason that "if the hash I was asking about is in that set, the user I want to talk to has Signal installed".
wolverine876 5y ago
> Because the app constantly prompts for contact-list access AFAIK, it prompts at first, maybe a few times, but then stops. > Signal's software-on-device definitely has the contact list Definitely not required at all. Signal can use its own contact list. > that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol The SGX enclaves are not for contact discovery. Contact discovery worked long before Signal implemented the SGX enclaves. As I understand it: The SGX enclaves store a crypto key that Signal adds to the user's password, to enable data migration: Users tend to choose weak passwords; if Signal truly wants their data to be secure, strong passwords aren't realistic. Their solution is ingenious (IMHO): 1) Append a random key to strengthen the password chosen by the user. 2) A locally stored key would be a big problem for data migration, such as lost phones; the key would be lost too, and thus all the user data. 3) Therefore, they store the key centrally, as securely as possible (in the SGX enclave). That does make the key more vulnerable, but if you choose a strong password then it's irrelevant - the attacker needs to defeat both the key and your password. You can also disable this backup feature if you like. Some reading (partly because I might misremember a detail or two): https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-th... I am not sure how Signal backups work or that user contacts, encrypted, are backed up to the SGX enclave. Where does it say that? > So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that deliver/update the Signal software on-device.) Again, if you choose a strong password then you only need to trust yourself, and I think you can disable it altogether.
- gojomo 5y ago
  > AFAIK, it prompts at first, maybe a few times, but then stops. It's been re-prompting me for years. If there's a time it stops, I haven't found it. > I am not sure how Signal backups work or that user contacts, encrypted, are backed up to the SGX enclave. Where does it say that? You're talking about backups. I'm talking about contact-discovery, wherein the client regularly sends (hashed versions of) all the phone numbers from your contacts (if you've shared them with the app) to Signal's servers, to let you (& them!) know you're both on Signal. How else would you think the notification you get when someone in your contact list joins Signal is generated? Signal's claim that these oft-repeated intersection operations leave no permanent records on their servers seemed (last I looked deeply) based on the SGX attestation: that your list is encrypted such that only the trusted code will process it. If Signal, or hackers, or Intel Corp, or the "Intel Community" can compromise SGX's guarantees, they can decrypt & log the full set of phone numbers uploaded. So again, it reduces to how much you trust Intel™ SGX®. (Also note that even if you do trust SGX, someone you've never met can, by having your phone number in their contacts, receive a notification when you join Signal. And separately from any SGX-mediated threats, a persistent attacker with privileged views of your devices' network traffic – such as via an ISP or mobile carrier – can get, via the volume & timing of traffic to and from Signal's servers, a pretty good idea of who you're talking to.)

by gojomo 5y ago

tptacek 5y ago

I haven't kept up with what they're doing so grain of salt on this, but I think this is incorrect. What they're moving towards is a design that looks like what Apple did with their HSM quorum system. The contact information we're talking about is encrypted clientside, but with (usually) a memorable pin. Without countermeasures, memorable PINs are very easy to attack; SGX allows them to artificially limit guesses. As a user, you retain a security dial on this: you can use a more complicated passcode than a 4-digit pin if you don't trust SGX. Obtaining the whole database Signal maintains gives you ciphertext that you need to mount attacks on user-by-user (and to make those attacks, you'd have to break SGX). It doesn't simply give you the plaintext SQL database other messaging systems collect.

gojomo 5y ago
Yes, if you "break SGX", Signal's contact-intersection-privacy guarantees fall. Are you confident that SGX is unbroken?
stavros 5y ago
AFAIK they don't encrypt the contact list, they hash each number and send a few bits of the hash to the server. The server replies with a few possible hashes it knows about, so the client can reason that "if the hash I was asking about is in that set, the user I want to talk to has Signal installed".

wolverine876 5y ago

> Because the app constantly prompts for contact-list access AFAIK, it prompts at first, maybe a few times, but then stops. > Signal's software-on-device definitely has the contact list Definitely not required at all. Signal can use its own contact list. > that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol The SGX enclaves are not for contact discovery. Contact discovery worked long before Signal implemented the SGX enclaves. As I understand it: The SGX enclaves store a crypto key that Signal adds to the user's password, to enable data migration: Users tend to choose weak passwords; if Signal truly wants their data to be secure, strong passwords aren't realistic. Their solution is ingenious (IMHO): 1) Append a random key to strengthen the password chosen by the user. 2) A locally stored key would be a big problem for data migration, such as lost phones; the key would be lost too, and thus all the user data. 3) Therefore, they store the key centrally, as securely as possible (in the SGX enclave). That does make the key more vulnerable, but if you choose a strong password then it's irrelevant - the attacker needs to defeat both the key and your password. You can also disable this backup feature if you like. Some reading (partly because I might misremember a detail or two): https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-th... I am not sure how Signal backups work or that user contacts, encrypted, are backed up to the SGX enclave. Where does it say that? > So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that deliver/update the Signal software on-device.) Again, if you choose a strong password then you only need to trust yourself, and I think you can disable it altogether.

gojomo 5y ago
> AFAIK, it prompts at first, maybe a few times, but then stops. It's been re-prompting me for years. If there's a time it stops, I haven't found it. > I am not sure how Signal backups work or that user contacts, encrypted, are backed up to the SGX enclave. Where does it say that? You're talking about backups. I'm talking about contact-discovery, wherein the client regularly sends (hashed versions of) all the phone numbers from your contacts (if you've shared them with the app) to Signal's servers, to let you (& them!) know you're both on Signal. How else would you think the notification you get when someone in your contact list joins Signal is generated? Signal's claim that these oft-repeated intersection operations leave no permanent records on their servers seemed (last I looked deeply) based on the SGX attestation: that your list is encrypted such that only the trusted code will process it. If Signal, or hackers, or Intel Corp, or the "Intel Community" can compromise SGX's guarantees, they can decrypt & log the full set of phone numbers uploaded. So again, it reduces to how much you trust Intel™ SGX®. (Also note that even if you do trust SGX, someone you've never met can, by having your phone number in their contacts, receive a notification when you join Signal. And separately from any SGX-mediated threats, a persistent attacker with privileged views of your devices' network traffic – such as via an ISP or mobile carrier – can get, via the volume & timing of traffic to and from Signal's servers, a pretty good idea of who you're talking to.)