5 ms·

I might be out of the loop a little bit, but wasn't Telegram the first that offered E2E encryption[1] for the "general public" (at least it was very popular in

I might be out of the loop a little bit, but wasn't Telegram the first that offered E2E encryption[1] for the "general public" (at least it was very popular in Europe)? So, I feel attributing WhatsApp etc implementing E2E because of Signal is overselling it a bit. [1] I know there was some controversy because someone (Signal, maybe?) accused them of using a custom encryption scheme that was poorly designed. I didn't follow that drama very closely, but given Telegram is still around and there hasn't been any outrageous news claiming its encryption getting cracked, I assume it was a mistaken claim.

lxgr 3y ago
No, Telegram was neither the first to offer end-to-end encryption (Signal started out as TextSecure in 2010), nor do they make end-to-end encryption the default. Defaults matter. > given Telegram is still around and there hasn't been any outrageous news claiming its encryption getting cracked, I assume it was a mistaken claim. “Innocent until proven guilty” is for criminal systems, not security analysis. And the controversy you are referring to, regarding unusual (to put it mildly) design choices in their E2E protocol is indeed very concerning, but the fact that Telegram by default is not end-to-end encrypted and stores all chat history server-side in a way that is accessible to its operators is undisputed.
- spoiler 3y ago
  Oh, you're right about it not being the default. I could've sworn it was the default way back when, but I might be misremembering. Also wasn't aware Signal rebranded. > “Innocent until proven guilty” is for criminal systems, not security analysis. Sorry if this sounds ignorant; I'm not a cryptanalyst/security researcher. Isn't this kind of the norm in the industry? A few examples come to mind like hashing algorithms or encryption methods becoming obsolete over the years. Was that due to the innocent-until-guilty mindset, or because computational power just overtook those standards?
  - lxgr 3y ago
    > Isn't this kind of the norm in the industry? It's a bit of a mix of both! At the low level, we unfortunately can't do much more than hope that certain fundamental mathematical/computational complexity assumptions hold. For RSA, that's the assumption that factoring prime numbers is hard; for AES, it's the assumption that it's really hard to invert the pseudorandom permutation a given AES key and the algorithm description represents. We don't have formal proof for these assumptions (or really hopes) being true; some even suspect that these proofs are fundamentally impossible. In that sense, these really are assumed secure until proven otherwise (by counterexample). And one such counterexample to RSA, Diffie-Hellman and its elliptic curve variants are certain quantum computing algorithms! However, at the high level, there is the concept of security proofs. These are formal, and in a nutshell they (often) work by mapping a new/unknown problem or solution onto a known one we've already proven some property of. An example of that would be "if the decisional Diffie-Hellman assumption holds, running protocol x is a secure way of deriving a session key, and a passive observer can't derive the key themselves with non-negligible probability/without improbable resource expenditure" (obviously the actual formalism is much more involved). In that sense, at the high level, there are positive security proofs, and this is the kind of work that the researchers working on Signal do. It's much harder than clobbering together a few low-level cryptographic primitives and hoping that they'll stick securely, but it's the best approach we have!
    - spoiler 3y ago
      Thanks for the thoughtful and detailed reply!

lxgr 3y ago

No, Telegram was neither the first to offer end-to-end encryption (Signal started out as TextSecure in 2010), nor do they make end-to-end encryption the default. Defaults matter. > given Telegram is still around and there hasn't been any outrageous news claiming its encryption getting cracked, I assume it was a mistaken claim. “Innocent until proven guilty” is for criminal systems, not security analysis. And the controversy you are referring to, regarding unusual (to put it mildly) design choices in their E2E protocol is indeed very concerning, but the fact that Telegram by default is not end-to-end encrypted and stores all chat history server-side in a way that is accessible to its operators is undisputed.

spoiler 3y ago
Oh, you're right about it not being the default. I could've sworn it was the default way back when, but I might be misremembering. Also wasn't aware Signal rebranded. > “Innocent until proven guilty” is for criminal systems, not security analysis. Sorry if this sounds ignorant; I'm not a cryptanalyst/security researcher. Isn't this kind of the norm in the industry? A few examples come to mind like hashing algorithms or encryption methods becoming obsolete over the years. Was that due to the innocent-until-guilty mindset, or because computational power just overtook those standards?
- lxgr 3y ago
  > Isn't this kind of the norm in the industry? It's a bit of a mix of both! At the low level, we unfortunately can't do much more than hope that certain fundamental mathematical/computational complexity assumptions hold. For RSA, that's the assumption that factoring prime numbers is hard; for AES, it's the assumption that it's really hard to invert the pseudorandom permutation a given AES key and the algorithm description represents. We don't have formal proof for these assumptions (or really hopes) being true; some even suspect that these proofs are fundamentally impossible. In that sense, these really are assumed secure until proven otherwise (by counterexample). And one such counterexample to RSA, Diffie-Hellman and its elliptic curve variants are certain quantum computing algorithms! However, at the high level, there is the concept of security proofs. These are formal, and in a nutshell they (often) work by mapping a new/unknown problem or solution onto a known one we've already proven some property of. An example of that would be "if the decisional Diffie-Hellman assumption holds, running protocol x is a secure way of deriving a session key, and a passive observer can't derive the key themselves with non-negligible probability/without improbable resource expenditure" (obviously the actual formalism is much more involved). In that sense, at the high level, there are positive security proofs, and this is the kind of work that the researchers working on Signal do. It's much harder than clobbering together a few low-level cryptographic primitives and hoping that they'll stick securely, but it's the best approach we have!
  - spoiler 3y ago
    Thanks for the thoughtful and detailed reply!