6 ms·

Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.

treprinum 2y ago
Why is home-rolled crypto inherently insecure?
- OSI-Auflauf 2y ago
  Because theirs was particularly bad. They xored a server provided nonce in their modified DH scheme making their side able to mitm the key exchanges.
- hcks 2y ago
  It’s not been audited by CIA approved programmers
- ale42 2y ago
  Because doing proper crypto is VERY hard. You might think you've gotten the ultimate security and one year later someone will defeat it (or cryptanalize within a practical limit, which boils down to the same), because you forgot a detail. Even just implementing a crypto algorithm properly in a way that doesn't leak information is very complex, reason for which most applications tend to use well-established crypto libraries.
- richardw 2y ago
  Good answers here: https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own https://security.stackexchange.com/questions/18197/why-shoul... I’d do a disservice to try copy and paste here so rather look at the top answer
- danpalmer 2y ago
  It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily. It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".
  - kaba0 2y ago
    It’s insecure if done by your average full stack developer, that barely passed high school math. That’s why the usual mantra. It’s waaay different when done by math experts specialized in this topic, as is the case with telegram.
    - MatejKafka 2y ago
      Math experts are not necessarily good cryptographers, and authors of MTProto were not renowned cryptographers (unlike with Signal). Most people in the cryptographic community agree that the Signal protocol is well-designed, is widely believed to be secure, and the authors react openly and swiftly to potential issues. Meanwhile, a lot of the MTProto crypto is just weird (that is, it does not follow standard practices of the field, without strong reasons to do so), and many cryptographers treat it with suspicion.
- supriyo-biswas 2y ago
  In the case of Telegram, MTProto’s implementation leaves a lot to be desired[1][2]. Additionally, home rolled crypto does not usually get the kind of security review from the cryptography community which makes it very likely that bugs of all kinds exist. [1] https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/ [2] http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
  - martinralbrecht 2y ago
    Telegram's symmetric cryptography has been reviewed by cryptographers: https://mtpsym.github.io/ https://mtpsym.github.io/
- GuB-42 2y ago
  To add to the idea that crypto is hard, it is not just hard in the same way that, say, making a physics engine is hard. It is hard because there is no telltale sign you did it wrong. All crypto algorithms, even weak ones output what looks like random numbers that can be deciphered back into the original plaintext. Just by looking at it, there is no way to differentiate between secure and insecure crypto. Contrast to a physics engine, it is hard to get right, but at least, if you did it wrong, it tends to be obvious. Also, like everything security-related, it is adverserial. You may have some of the smartest and most resourceful guys on the planet working to break your thing. It is worse than even critical systems. Aircraft engine control is critical, people may die if it goes wrong, so robustness and correctness are crucial, but at least, pilots won't go out of their way to break it.
- martinralbrecht 2y ago
  We explain this under the heading "A Somewhat Opinionated Discussion" here: https://mtpsym.github.io/ https://mtpsym.github.io/ which is our security analysis of MTProto's symmetric cryptography.
bozey07 2y ago
Why is MTProto considered "home-rolled" but the Signal Protocol isn't? Both are boutique and written from scratch to fit their respective systems.
- lynndotpy 2y ago
  Of course. But the history of the Signal protocol and implementation traces back 20 years. It's good enough that Facebook, WhatsApp, and Skype use it for E2EE messages. Telegram's traces back 10 years, the first version was very bad, and both versions have had a lot of scrutiny for weird design decisions. Crypto schemes which get broken usually follow a pattern of "something smells wrong", "we have weakened it a little bit", "we have weakened it a little bit more", "this is now completely broken", "my god why are you still using MD5, it's 2017". We're in the "something smells wrong" or "we have weakened it a little bit" phase for MTProto2, depending on how you view it.
  - palata 2y ago
    > But the history of the Signal protocol and implementation traces back 20 years Are you sure about that? TextSecure was created more 10 years ago than 20. 20 years ago, we did not have smartphones. As I remember, TextSecure started with SMS (but that was not the Signal protocol) and added "internet" messages right after WhatsApp got bought (which was about when Telegram was started). I love the Signal protocol, but I would say it's more 10 years old (like Telegram). Or am I missing something?
    - lynndotpy 2y ago
      Signal/TextSecure (/DRA/Axolotl) has a pretty strong throughline from the "off-the-record" protocol (OTR) from 2004/2005. Signal themselves describes TextSecure as a derivative of OTR (https://signal.org/blog/simplifying-otr-deniability/ https://signal.org/blog/simplifying-otr-deniability/). It's close enough that if, say, a novel attack against OTR were discovered today, the first thing I'd want to know is if there are any implications against Signal.
fastball 2y ago
Technically Signal is using their own home-rolled crypto, too – right?
- imjonse 2y ago
  Telegram had some weird primitives which they said we should trust because they were made by their top team of mathematicians. Signal builds on widely used crypto primitives even if their protocol is their own (vetted by actual cryptographers though)
- api 2y ago
  Sort of, but it's heavily peer reviewed and generally regarded as very good. I really dislike the "hand rolled is bad" meme. Someone rolled all crypto. The questions are "who is doing the rolling," "do they know what they are doing," and "was it peer reviewed or directly and faithfully built from a peer reviewed design?"
  - Sebb767 2y ago
    > I really dislike the "hand rolled is bad" meme. Crypto is notoriously easy to get wrong, even if you know a lot about it - and most people do not. Secondly, proving something secure is pretty hard as well. If the crypto isn't a bog-standard algorithm in a well-known and reviewed implementation, assuming it to be insecure is a pretty good rule of thumb.
    - api 2y ago
      My take on "don't roll your own" is: The people who take this advice are people who have respect for the difficulty of things like crypto and should be the ones implementing it, or at least on-ramped into learning how to do so. The sorts of people who ship bad crypto because they don't bother to learn anything about the field are going to ignore this advice. So I think as a strategy for fighting bad crypto it's neutral or maybe even net-negative by discouraging the right people from learning crypto and having no effect on overconfident fools.

treprinum 2y ago

Why is home-rolled crypto inherently insecure?

OSI-Auflauf 2y ago
Because theirs was particularly bad. They xored a server provided nonce in their modified DH scheme making their side able to mitm the key exchanges.
hcks 2y ago
It’s not been audited by CIA approved programmers
ale42 2y ago
Because doing proper crypto is VERY hard. You might think you've gotten the ultimate security and one year later someone will defeat it (or cryptanalize within a practical limit, which boils down to the same), because you forgot a detail. Even just implementing a crypto algorithm properly in a way that doesn't leak information is very complex, reason for which most applications tend to use well-established crypto libraries.
richardw 2y ago
Good answers here: https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own https://security.stackexchange.com/questions/18197/why-shoul... I’d do a disservice to try copy and paste here so rather look at the top answer
danpalmer 2y ago
It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily. It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".
- kaba0 2y ago
  It’s insecure if done by your average full stack developer, that barely passed high school math. That’s why the usual mantra. It’s waaay different when done by math experts specialized in this topic, as is the case with telegram.
  - MatejKafka 2y ago
    Math experts are not necessarily good cryptographers, and authors of MTProto were not renowned cryptographers (unlike with Signal). Most people in the cryptographic community agree that the Signal protocol is well-designed, is widely believed to be secure, and the authors react openly and swiftly to potential issues. Meanwhile, a lot of the MTProto crypto is just weird (that is, it does not follow standard practices of the field, without strong reasons to do so), and many cryptographers treat it with suspicion.
supriyo-biswas 2y ago
In the case of Telegram, MTProto’s implementation leaves a lot to be desired[1][2]. Additionally, home rolled crypto does not usually get the kind of security review from the cryptography community which makes it very likely that bugs of all kinds exist. [1] https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/ [2] http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
- martinralbrecht 2y ago
  Telegram's symmetric cryptography has been reviewed by cryptographers: https://mtpsym.github.io/ https://mtpsym.github.io/
GuB-42 2y ago
To add to the idea that crypto is hard, it is not just hard in the same way that, say, making a physics engine is hard. It is hard because there is no telltale sign you did it wrong. All crypto algorithms, even weak ones output what looks like random numbers that can be deciphered back into the original plaintext. Just by looking at it, there is no way to differentiate between secure and insecure crypto. Contrast to a physics engine, it is hard to get right, but at least, if you did it wrong, it tends to be obvious. Also, like everything security-related, it is adverserial. You may have some of the smartest and most resourceful guys on the planet working to break your thing. It is worse than even critical systems. Aircraft engine control is critical, people may die if it goes wrong, so robustness and correctness are crucial, but at least, pilots won't go out of their way to break it.
martinralbrecht 2y ago
We explain this under the heading "A Somewhat Opinionated Discussion" here: https://mtpsym.github.io/ https://mtpsym.github.io/ which is our security analysis of MTProto's symmetric cryptography.

bozey07 2y ago

Why is MTProto considered "home-rolled" but the Signal Protocol isn't? Both are boutique and written from scratch to fit their respective systems.

lynndotpy 2y ago
Of course. But the history of the Signal protocol and implementation traces back 20 years. It's good enough that Facebook, WhatsApp, and Skype use it for E2EE messages. Telegram's traces back 10 years, the first version was very bad, and both versions have had a lot of scrutiny for weird design decisions. Crypto schemes which get broken usually follow a pattern of "something smells wrong", "we have weakened it a little bit", "we have weakened it a little bit more", "this is now completely broken", "my god why are you still using MD5, it's 2017". We're in the "something smells wrong" or "we have weakened it a little bit" phase for MTProto2, depending on how you view it.
- palata 2y ago
  > But the history of the Signal protocol and implementation traces back 20 years Are you sure about that? TextSecure was created more 10 years ago than 20. 20 years ago, we did not have smartphones. As I remember, TextSecure started with SMS (but that was not the Signal protocol) and added "internet" messages right after WhatsApp got bought (which was about when Telegram was started). I love the Signal protocol, but I would say it's more 10 years old (like Telegram). Or am I missing something?
  - lynndotpy 2y ago
    Signal/TextSecure (/DRA/Axolotl) has a pretty strong throughline from the "off-the-record" protocol (OTR) from 2004/2005. Signal themselves describes TextSecure as a derivative of OTR (https://signal.org/blog/simplifying-otr-deniability/ https://signal.org/blog/simplifying-otr-deniability/). It's close enough that if, say, a novel attack against OTR were discovered today, the first thing I'd want to know is if there are any implications against Signal.

fastball 2y ago

Technically Signal is using their own home-rolled crypto, too – right?

imjonse 2y ago
Telegram had some weird primitives which they said we should trust because they were made by their top team of mathematicians. Signal builds on widely used crypto primitives even if their protocol is their own (vetted by actual cryptographers though)
api 2y ago
Sort of, but it's heavily peer reviewed and generally regarded as very good. I really dislike the "hand rolled is bad" meme. Someone rolled all crypto. The questions are "who is doing the rolling," "do they know what they are doing," and "was it peer reviewed or directly and faithfully built from a peer reviewed design?"
- Sebb767 2y ago
  > I really dislike the "hand rolled is bad" meme. Crypto is notoriously easy to get wrong, even if you know a lot about it - and most people do not. Secondly, proving something secure is pretty hard as well. If the crypto isn't a bog-standard algorithm in a well-known and reviewed implementation, assuming it to be insecure is a pretty good rule of thumb.
  - api 2y ago
    My take on "don't roll your own" is: The people who take this advice are people who have respect for the difficulty of things like crypto and should be the ones implementing it, or at least on-ramped into learning how to do so. The sorts of people who ship bad crypto because they don't bother to learn anything about the field are going to ignore this advice. So I think as a strategy for fighting bad crypto it's neutral or maybe even net-negative by discouraging the right people from learning crypto and having no effect on overconfident fools.