4 ms·

I don't get it. Can you explain me why it is, and what the emojis represent? Do you have the projection of some binary string in the unicode emoji space? (then

by csdvrx 3y ago

I don't get it. Can you explain me why it is, and what the emojis represent? Do you have the projection of some binary string in the unicode emoji space? (then you'd need to chunk it and possibly use many emojis)

vecter 3y ago
It's just a fingerprint for their chat. It's almost the same as a random four-letter code to verify that you're both seeing the ame thing.
- stavros 3y ago
  This is for calls, not chat. It's probably ZRTP (hash commitment) with emojis instead of letters.
progval 3y ago
I don't know about Telegram, but it is indeed how Matrix does it. Here is the encoding they use: https://spec.matrix.org/v1.8/client-server-api/#sas-method-emoji https://spec.matrix.org/v1.8/client-server-api/#sas-method-e...
- csdvrx 3y ago
  I read https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-calculation https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-cal... So is it the representation in emojis of a server controlled shared secret? That'd make 2 clients talking to eachother through the server vulnerable to tampering at the server level (ex:MITM) Shouldn't the 2 clients not involve the server for the secret? This would require each of them being able to access the other public key fingerprint without trusting what the server says. But if they see eachother fingerprint projected into the unicode emoji space, they would see different emojis. I think I may be missing something obvious. I just don't understand this trick.
  - bloopernova 3y ago
    As far as I know, if the 2 clients talk directly, their IP addresses are exposed to each other.
  - Arathorn 3y ago
    It’s not a server controlled secret; it’s a MAC of a shared secret negotiated via ECDH between the two clients. Diffie Hellman ftw. See https://www.uhoreg.ca/blog/20190514-1146 https://www.uhoreg.ca/blog/20190514-1146
- cbm-vic-20 3y ago
  So, 64 symbols. That same amount of information could be conveyed with lowercase letters, uppercase letters, digits, and two additional symbols, just like Base64. That seems a lot more straightforward than trying to interpret what each emoji represents. To my old eyes, a lot of the chosen animal emojis look really similar. Or take symbol 34 for example, listed there as "spanner" (wrench). Unless I zoom in pretty far, that one looks like a diagonal line.
sgjohnson 3y ago
Essentially, the fingerprint. Emojis take up 32 bits each. So 4 emojis would be 128 bits. Of course, this doesn't account for all the 4 byte unicode combos that don't result in an emoji, but still.

by csdvrx 3y ago

vecter 3y ago

It's just a fingerprint for their chat. It's almost the same as a random four-letter code to verify that you're both seeing the ame thing.

stavros 3y ago
This is for calls, not chat. It's probably ZRTP (hash commitment) with emojis instead of letters.

progval 3y ago

I don't know about Telegram, but it is indeed how Matrix does it. Here is the encoding they use: https://spec.matrix.org/v1.8/client-server-api/#sas-method-emoji https://spec.matrix.org/v1.8/client-server-api/#sas-method-e...

csdvrx 3y ago
I read https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-calculation https://spec.matrix.org/v1.8/client-server-api/#sas-hkdf-cal... So is it the representation in emojis of a server controlled shared secret? That'd make 2 clients talking to eachother through the server vulnerable to tampering at the server level (ex:MITM) Shouldn't the 2 clients not involve the server for the secret? This would require each of them being able to access the other public key fingerprint without trusting what the server says. But if they see eachother fingerprint projected into the unicode emoji space, they would see different emojis. I think I may be missing something obvious. I just don't understand this trick.
- bloopernova 3y ago
  As far as I know, if the 2 clients talk directly, their IP addresses are exposed to each other.
- Arathorn 3y ago
  It’s not a server controlled secret; it’s a MAC of a shared secret negotiated via ECDH between the two clients. Diffie Hellman ftw. See https://www.uhoreg.ca/blog/20190514-1146 https://www.uhoreg.ca/blog/20190514-1146
cbm-vic-20 3y ago
So, 64 symbols. That same amount of information could be conveyed with lowercase letters, uppercase letters, digits, and two additional symbols, just like Base64. That seems a lot more straightforward than trying to interpret what each emoji represents. To my old eyes, a lot of the chosen animal emojis look really similar. Or take symbol 34 for example, listed there as "spanner" (wrench). Unless I zoom in pretty far, that one looks like a diagonal line.

sgjohnson 3y ago

Essentially, the fingerprint. Emojis take up 32 bits each. So 4 emojis would be 128 bits. Of course, this doesn't account for all the 4 byte unicode combos that don't result in an emoji, but still.