3 ms·
> 6. The hash function is broken. I'm not sure if this matters too much here, but I'm also not sure that it doesn't matter. They are using SHA-1, which is inde
by decasteve 13y ago
> 6. The hash function is broken. I'm not sure if this matters too much here, but I'm also not sure that it doesn't matter.
They are using SHA-1, which is indeed broken, not as broken as MD5 and its predecessors yet, but still less than a birthday attack.
> The message key is defined as the 128 lower-order bits of the SHA1 of the message body (including session, message ID, etc.).
A reduced SHA-1 cut down from 160 to 128 bits is not collision resistant. I'm not sure what implication this has for this protocol but if strong collision resistance is required this may be a point of weakness.
- jacobolus 13y agoI think you missed: “Both Alice and Bob now compute message_key = MD2(super_secret) (we know you like dated crypto, so we thought you’d like the MD2 hash function).”
- sdevlin 13y agoSorry, I'm afraid my original post wasn't very clear. I was describing potential problems with Moxie's intentionally weak protocol, not with Telegram. The hash in question is MD2 used to reduce the 32-byte random secret to a 16-byte shared encryption key. MD2 is weak, but I'm not sure if it matters in this context. As I said above though, I'm also not sure that it doesn't matter.