4 ms·

MTProto 2 uses standard primitives. I'd also like to point out that not "rolling your own crypto" falls apart the moment you ask who rolled whoever's "blessed"

MTProto 2 uses standard primitives. I'd also like to point out that not "rolling your own crypto" falls apart the moment you ask who rolled whoever's "blessed" crypto. How this trite saying ever got any traction without pushback is beyond me.

tptacek 4y ago
It does? From Telegram's documentation, it looks like it's still using AES IGE. Telegram, meanwhile, can as far as I understand it encrypt only one-to-one private messages, not groups, and does so on an opt-in basis, in part because their "standard primitives" don't support the usage model of modern secure messengers, which do multiple levels of cryptographic ratcheting using actually-standard KDFs, hashes, authenticated ciphers, and authenticated elliptic curve key exchanges. Further, outside of Signal, whose authors won the RWC Levchin Prize for their design work, the other modern secure messengers essentially don't roll their own: they draft off the design work Signal did. Which is a good thing for their users. The alternative course, of coming up with your own special snowflake crypto, gets you papers like the one we're commenting on.
- jorvi 4y ago
  For all the disparaging MTProto gets, it still hasn’t ever been broken in practice. That doesn’t mean it was a great idea for them to pseudo-‘roll their own’, but it doesn’t deserve the vehement hatred that is constantly poured over it.
  - tptacek 4y ago
    For all the disparaging Mega got, it hadn't been broken until today.
tatersolid 4y ago
The Telegram protocol I’m so critical of was v1 which included DH, RSA, AES in IGE mode, and SHA1. All used in random ways with key sub setting, reuse of some key bits for multiple purposes, etc. https://core.telegram.org/mtproto/description_v1 https://core.telegram.org/mtproto/description_v1 I honestly haven’t looked into anything newer from Telegram because it was pretty clearly a tire-fire and Signal was already a thing.

tptacek 4y ago

It does? From Telegram's documentation, it looks like it's still using AES IGE. Telegram, meanwhile, can as far as I understand it encrypt only one-to-one private messages, not groups, and does so on an opt-in basis, in part because their "standard primitives" don't support the usage model of modern secure messengers, which do multiple levels of cryptographic ratcheting using actually-standard KDFs, hashes, authenticated ciphers, and authenticated elliptic curve key exchanges. Further, outside of Signal, whose authors won the RWC Levchin Prize for their design work, the other modern secure messengers essentially don't roll their own: they draft off the design work Signal did. Which is a good thing for their users. The alternative course, of coming up with your own special snowflake crypto, gets you papers like the one we're commenting on.

jorvi 4y ago
For all the disparaging MTProto gets, it still hasn’t ever been broken in practice. That doesn’t mean it was a great idea for them to pseudo-‘roll their own’, but it doesn’t deserve the vehement hatred that is constantly poured over it.
- tptacek 4y ago
  For all the disparaging Mega got, it hadn't been broken until today.

tatersolid 4y ago

The Telegram protocol I’m so critical of was v1 which included DH, RSA, AES in IGE mode, and SHA1. All used in random ways with key sub setting, reuse of some key bits for multiple purposes, etc. https://core.telegram.org/mtproto/description_v1 https://core.telegram.org/mtproto/description_v1 I honestly haven’t looked into anything newer from Telegram because it was pretty clearly a tire-fire and Signal was already a thing.