4 ms·

Why is home-rolled crypto inherently insecure?

OSI-Auflauf 2y ago
Because theirs was particularly bad. They xored a server provided nonce in their modified DH scheme making their side able to mitm the key exchanges.
hcks 2y ago
It’s not been audited by CIA approved programmers
ale42 2y ago
Because doing proper crypto is VERY hard. You might think you've gotten the ultimate security and one year later someone will defeat it (or cryptanalize within a practical limit, which boils down to the same), because you forgot a detail. Even just implementing a crypto algorithm properly in a way that doesn't leak information is very complex, reason for which most applications tend to use well-established crypto libraries.
richardw 2y ago
Good answers here: https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own https://security.stackexchange.com/questions/18197/why-shoul... I’d do a disservice to try copy and paste here so rather look at the top answer
danpalmer 2y ago
It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily. It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".
- kaba0 2y ago
  It’s insecure if done by your average full stack developer, that barely passed high school math. That’s why the usual mantra. It’s waaay different when done by math experts specialized in this topic, as is the case with telegram.
  - MatejKafka 2y ago
    Math experts are not necessarily good cryptographers, and authors of MTProto were not renowned cryptographers (unlike with Signal). Most people in the cryptographic community agree that the Signal protocol is well-designed, is widely believed to be secure, and the authors react openly and swiftly to potential issues. Meanwhile, a lot of the MTProto crypto is just weird (that is, it does not follow standard practices of the field, without strong reasons to do so), and many cryptographers treat it with suspicion.
supriyo-biswas 2y ago
In the case of Telegram, MTProto’s implementation leaves a lot to be desired[1][2]. Additionally, home rolled crypto does not usually get the kind of security review from the cryptography community which makes it very likely that bugs of all kinds exist. [1] https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/ [2] http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
- martinralbrecht 2y ago
  Telegram's symmetric cryptography has been reviewed by cryptographers: https://mtpsym.github.io/ https://mtpsym.github.io/
GuB-42 2y ago
To add to the idea that crypto is hard, it is not just hard in the same way that, say, making a physics engine is hard. It is hard because there is no telltale sign you did it wrong. All crypto algorithms, even weak ones output what looks like random numbers that can be deciphered back into the original plaintext. Just by looking at it, there is no way to differentiate between secure and insecure crypto. Contrast to a physics engine, it is hard to get right, but at least, if you did it wrong, it tends to be obvious. Also, like everything security-related, it is adverserial. You may have some of the smartest and most resourceful guys on the planet working to break your thing. It is worse than even critical systems. Aircraft engine control is critical, people may die if it goes wrong, so robustness and correctness are crucial, but at least, pilots won't go out of their way to break it.
martinralbrecht 2y ago
We explain this under the heading "A Somewhat Opinionated Discussion" here: https://mtpsym.github.io/ https://mtpsym.github.io/ which is our security analysis of MTProto's symmetric cryptography.

Because theirs was particularly bad. They xored a server provided nonce in their modified DH scheme making their side able to mitm the key exchanges.

hcks 2y ago

It’s not been audited by CIA approved programmers

ale42 2y ago

Because doing proper crypto is VERY hard. You might think you've gotten the ultimate security and one year later someone will defeat it (or cryptanalize within a practical limit, which boils down to the same), because you forgot a detail. Even just implementing a crypto algorithm properly in a way that doesn't leak information is very complex, reason for which most applications tend to use well-established crypto libraries.

richardw 2y ago

Good answers here: https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own https://security.stackexchange.com/questions/18197/why-shoul... I’d do a disservice to try copy and paste here so rather look at the top answer

danpalmer 2y ago

It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily. It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".

kaba0 2y ago
It’s insecure if done by your average full stack developer, that barely passed high school math. That’s why the usual mantra. It’s waaay different when done by math experts specialized in this topic, as is the case with telegram.
- MatejKafka 2y ago
  Math experts are not necessarily good cryptographers, and authors of MTProto were not renowned cryptographers (unlike with Signal). Most people in the cryptographic community agree that the Signal protocol is well-designed, is widely believed to be secure, and the authors react openly and swiftly to potential issues. Meanwhile, a lot of the MTProto crypto is just weird (that is, it does not follow standard practices of the field, without strong reasons to do so), and many cryptographers treat it with suspicion.

supriyo-biswas 2y ago

In the case of Telegram, MTProto’s implementation leaves a lot to be desired[1][2]. Additionally, home rolled crypto does not usually get the kind of security review from the cryptography community which makes it very likely that bugs of all kinds exist. [1] https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/ [2] http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac...

martinralbrecht 2y ago
Telegram's symmetric cryptography has been reviewed by cryptographers: https://mtpsym.github.io/ https://mtpsym.github.io/

GuB-42 2y ago

To add to the idea that crypto is hard, it is not just hard in the same way that, say, making a physics engine is hard. It is hard because there is no telltale sign you did it wrong. All crypto algorithms, even weak ones output what looks like random numbers that can be deciphered back into the original plaintext. Just by looking at it, there is no way to differentiate between secure and insecure crypto. Contrast to a physics engine, it is hard to get right, but at least, if you did it wrong, it tends to be obvious. Also, like everything security-related, it is adverserial. You may have some of the smartest and most resourceful guys on the planet working to break your thing. It is worse than even critical systems. Aircraft engine control is critical, people may die if it goes wrong, so robustness and correctness are crucial, but at least, pilots won't go out of their way to break it.

martinralbrecht 2y ago

We explain this under the heading "A Somewhat Opinionated Discussion" here: https://mtpsym.github.io/ https://mtpsym.github.io/ which is our security analysis of MTProto's symmetric cryptography.