5 ms·
The reason that cryptographers laugh at people who advertise "military grade cryptography" or "we use AES256" is because the choice of crypto primitives is ofte
by moxie 13y ago
The reason that cryptographers laugh at people who advertise "military grade cryptography" or "we use AES256" is because the choice of crypto primitives is often less important than how they're composed. Those phrases tend to reflect a critical misunderstanding of that, and often mean that a project is using secure primitives in a way that completely undermines their security.
At a glance, while this project is using secure (if aging) primitives, they've made some extremely unusual protocol choices that they need to publicly justify rather than simply describing in an API doc. Just at a glance, the use of modes like Infinite Garble Extension (a failed mode for Kerberos) is troubling, they made up their own KDF (with no proof), and they make what appear to be some amateur mistakes with how they use RSA.
I'm obviously biased, but if you want a mobile-oriented asynchronous messaging protocol, at this point I think the Axolotl ratchet should absolutely be its basis: https://www.whispersystems.org/blog/advanced-ratcheting/ https://www.whispersystems.org/blog/advanced-ratcheting/
If Telegram folks are on this thread, I'd encourage you to take a look at the TextSecure protocol. If you think it's interesting, you can federate into our network, get a provably secure asynchronous forward secrecy protocol, and also have access to an existing 10MM user base.
- zmanian 13y agoI'd immediately adopt a cloud messaging system from whisper systems. Always find your critiques extremely informative. :-)
- TelegramApp 13y agoTwo questions for you: 1. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know. 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. Thank you for the offer to join in the project you represent. However, we feel that what we are doing is going in a somewhat different direction and has its own potential. The team behind Telegram, led by Nikolai Durov, consists of six ACM champions, half of them Ph.Ds in math. It took them about two years to roll out the current version of MTProto. Names and degrees may indeed not mean as much in some fields as they do in others, but this protocol is the result of thougtful and prolonged work of professionals. The basic copy on telegram.org rightfully appears as simplistic to the Hacker News resident. It was written for the general public, since we want to bring secure messaging to the masses — not just to the security geek, who has it already (in oh so many forms). But for the technically minded we provided rather detailed documentation for our protocol: http://core.telegram.org/mtproto http://core.telegram.org/mtproto and API: http://core.telegram.org/api http://core.telegram.org/api We would be glad to respond to criticism, but not on the level of "I looked at it for 4 minutes, maybe they didn't think about X" (as another guy in the comments below put it), or "why didn't you just use this?". If anybody here can identify a specific point and prove that it is vulnerable and can be hacked a certain way, we are ready to respond and\or fix, if neccessary. Gentlemen?
- huhtenberg 13y ago> this protocol is the result of thougtful and prolonged work of professionals. Pray tell, why replay protection is done after decryption.
- TelegramApp 13y agoIn terms of DoS possibilities, one doesn't need to replay old messages, they could just as easily send new ones or random garbage. We could employ additional filtering techniques, but that increases processing time. And since modern hardware allows for very fast AES decryption, there is no particular gain in building additional layers of protection. All that, naturally, implies that other anti-DoS measures are also being used.
- rblaze 13y agoReplay protection isn't about DoS attacks. Replay protections is about re-injecting previous messages to confuse recipient.
- phaus 13y agoWell, you just made it painfully clear that at least one member of your team doesn't understand what a replay is. In light of that, why would anyone in their right mind use a security product your organization developed?
- danabramov 13y agoPlease mind that Telegram team are not native English speakers.
- phaus 13y agoAh, that makes more sense then them not knowing what a replay is. Their writing is good enough that I didn't notice they weren't from an English speaking country.
- 13y ago