10 ms·
Telegram protocol defeated. Authors are going to modify crypto-algorithm
- ge0rg 13y agoOn http://vk.com/wall-52630202_7858 http://vk.com/wall-52630202_7858 Pavel Durov writes that the finder of this vulnerability will receive a reward of $100k, and that comparable awards will be given for other findings. It looks like they are slowly making progress from a rigged show to a proper crypto evaluation situation.
- xytop 13y agoIn short: telegram in secure chats (http://core.telegram.org/api/end-to-end http://core.telegram.org/api/end-to-end) was using modified version of Diffie-Hellman algorithm: key = (pow(g_b, a) mod dh_prime) xor nonce (original: key = pow(g_b, a) mod dh_prime) That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed chats by request.. Authors of Telegram agreed that it is a big hole and their algorithm needs modification. User, who found the issue will get a prize (not 200,000$, but good enough).
- Jemaclus 13y agoWhy not the 200K? Was it outside the parameters of the contest or something?
- oakwhiz 13y agoTheir contest had very restrictive parameters if I recall correctly.
- hdevalence 13y agoYes. The contest is not about actually exposing flaws in their cryptosystem, which is why the rules are rigged up in a way that would allow even a terribly insecure protocol (like Telegram's, or Moxie's counter-challenge protocol) to pass as "secure".
- h0cked 13y agoTelegram's contest itself is meaningless regarding the security of its protocol (as others explained in details). Finding bugs such as this deserves 200k more than anything else
- ballard 13y agoOffering the contest was shady and stupid enough. Not paying just proves they're chiselers that never intended to pay in the first place. This wins the runner-up award for second most botched PR disaster ever. The consolation prize is a lump of coal.
- deleted 13y ago[deleted]
- phaus 13y agoThe contest was stupid and shady, but they did explicitly state the rules. Its not really fair to accuse them of wrongdoing if they don't give this guy $200,000. If I were in charge of telegram, I'd pay the guy the whole amount, but that would just be out of the kindness of my heart. Morally, they aren't obligated to pay just because the rules of their contest are ridiculous.
- danabramov 13y agoThey're paying $100 000. https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858
- ballard 13y agoIt's too late to matter. But good for him that they're only half crooked.
- xytop 13y agoYes, outside. Although the underground of this contest was to prove security and inability to read messages by 3rd parties contest was about decrypting Durov's chat. Chat is not decrypted and as many say - it's nearly impossible (http://thoughtcrime.org/blog/telegram-crypto-challenge/ http://thoughtcrime.org/blog/telegram-crypto-challenge/). But "bookmark" is found and it means that all the PR was shit. Telegram already removed 'xor nonce' from their documentation and added a new layer to their api but who knows where they will put a next bookmark. Probably it will be hidden in a deeper place. But trust is already lost. It appears that either their secure protocol was containing the bookmark specially or that protocol is getting written by non-specialists which cant guarantee any security.
- xytop 13y agoold copy of their doc which has 'xor nonce' inside: http://webcache.googleusercontent.com/search?q=cache:FAntx8lsBMQJ:https://core.telegram.org/api/end-to-end+&cd=1&hl=ru&ct=clnk&client=ubuntu http://webcache.googleusercontent.com/search?q=cache:FAntx8l...
- MatthewWilkes 13y agoTheir contest was based on a sample packet capture only.
- dewiz 13y agoSo this was supposed to be secure/robust/mature/trustworthy ? Not impressed, still too many companies around pretending it's sooo easy to make something better, how hard can it be ?
- knodi 13y ago200k gone just like that, better now then later.
- charlesdm 13y agoHe's not getting it apparently, even though he discovered a major flaw. Sounds like a great PR stunt gone bad for Telegram. What a joke.
- danabramov 13y agoHe's getting $100 000. https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858
- notastartup 13y agoI hope this person will get the full $200,000. I definitely don't think we can ever trust Telegram's strength again. They won't be paying him the full $200,000 even though he has rendered the Telegram to be weak. Major, major backfire for Telegram stakeholders.
- lososerg 13y agoThey gave him $100 000. And yet the flaw he pointed out doesn't help you read encrypted messages and has been already fixed/
- makomk 13y agoThe flaw he pointed out renders one of the main advertised features of Telegram - end-to-end encrypted chats that they can't eavesdrop on - broken to the point of total worthlessness. Telegram had the ability to undetectably MITM and spy on the supposedly secure communications, as did anyone who managed to compromise them. They'd have achieved exactly the same level of security by having no end-to-end encryption whatsoever and just promising that they wouldn't log or look at people's messages - this flaw is seriously that bad.
- nly 13y agoWhy does Telegram provide the generator (g and p) and then suggest validation and caching? These can be hardcoded parameters
- xytop 13y agoin cryptography nothing is hardcoded (or at least hardcoded values should have enough entropy) :) if client doesnt use caching - then every message user sends should obtain a new pair of p/g (which is expensive) - and it will make telegram not only insecure but also "slow" messenger :P
- nly 13y agoThe only things that aren't hardcoded in your typical secure cryptosystem is your key and a few nonces. In ECC the analogous components to p and g are defined extremely carefully and certainly wouldn't be changed willy nilly. I'm aware classic DH parameters are more liberal, but changing them for every session seems unnecessary.
- tigerweeds 13y agocool stuff. Give the guy his prize
- danabramov 13y agoHe gets $100 000: https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858
- a3n 13y agoHe didn't break the message. They weren't offering a prize for what he did.
- tigerweeds 13y agocool stuff. Give the guy his prize
- sillysaurus2 13y agoTextSecure's protocol, on the other hand, hasn't ever been compromised. Don't use Telegram. Use TextSecure. https://whispersystems.org/ https://whispersystems.org/
- foobarqux 13y agoBetter still, fund TextSecure not Telegram.
- moxie 13y agoThat's absolutely true, but I think the reason this seems so devastating for Telegram is not necessarily because there was a vulnerability, but because they were so dismissive of the feedback they got and so willing to immediately make such strong claims. The way I hope TextSecure can be different from Telegram is not by having an absolutely perfect security record forever (although that'd be great), but by publicly talking about the protocol choices we've made, employing constructions with proofs where possible, and actively soliciting feedback. Thanks for being involved!
- 11001 13y agoTo be fair, no one here mentioned anything related to the found vulnerability. Instead people seemed to have focused on their choice of SHA1 and IGE.
- MichaelGG 13y agoTo be fair, no one actually discovered the bridge was made of rotting wood. They seemed focused on the fact that math PhDs design it with no civil engineering background and stated plastic had no known defects.
- tomp 13y agoNo. They saw that the bridge was made of such a material, that it would collapse if the material turns out to be anything but steel-reinforced concrete. Which it was pretty likely to be, because it was designed by people who have been, up until now, building igloos.
- justinzollars 13y agoThat didn't take long.
- hcarvalhoalves 13y agoDemoralized twice, first for finding a flaw, second for not giving the prize.
- genwin 13y agoWhy give the prize for not doing what was needed to win the prize, namely reveal the message?
- shawabawa3 13y agoAs others have already said, the prize was essentially meaningless because the terms were so narrow. If the spirit of the prize was "if you break our crypto you win", this guy should win it. If the spirit of the prize was "we don't want to give away 200k, but we want to pretend we're secure", he shouldn't
- ballard 13y agoHoliday banter may go something like this: "Carnival booths, lawyers and politicians maybe the most honest... But there was once this company called Telegram that went the way of its namesake. Blah blah... for screwing over a Russian guy in a PR disaster of an unpaid $200k contest award. Maybe they should have offered a canned ham instead."
- genwin 13y agoI don't get it. If it's not secure why can't the message be revealed? What's the value of breaking someone's crypto if you are still unable to see the data unencrypted? Was the recipe for decryption given, with the actual decryption being much harder (terms so narrow, as you say)?
- alanh 13y agogenwin, I’ve invented a secure system. If you can tell me what this message says, you win $200k: jo You don’t know what the message says, because it’s so short. You will never win the prize. But my system was not so secure. My cipher system was this: Take a message and type it on a US Qwerty keyboard, but shift every letter over one place. So `hi` became `jo`. Not very strong. It would easily be cracked with a message consisting of an actual sentence or two. Now, with Telegraph, it wasn’t just length of the message involved, but additional information; still, the conditions are so narrow that it doesn’t apply to the real world. Just like I’d never simply send you a message that said "hi", Telegraph would be used in ways beyond one simple back-and-forth exchange, so it artificially limits the information available to a cracker. Make sense? See also: The BEAST attack or the general class of side channel attacks.
- T3RMINATED 13y agoWhy expose this publicly you wont get anything, save it and sell it.
- droopybuns 13y agoExcruciating evidence that supports Moxie's position. Vuln rewards should exist for two purposes: 1)An act of good faith on the part of the developer that says "I am interested in securing my product and I won't prosecute direct disclosure" 2) The Dev knows exploitable vuln discovery has value, but cannot compete with black market pricing. Instead, the reward is a token of appreciation for a shared code of ethics. I wish bug bounties could compete with the budgets of nation states. They can't. Companies shouldn't pretend to compete. Shame on telegram for stupidly false promises.
- danabramov 13y agoI have no idea what you are trying to say here. The guy is rewarded half the bounty: https://vk.com/wall-52630202_7858 https://vk.com/wall-52630202_7858
- droopybuns 13y agoVuln reward programs that payout at this level are broken. 1) They don't achieve their objective of securing a product. Moxie eloquently captured why here: http://thoughtcrime.org/blog/telegram-crypto-challenge/ http://thoughtcrime.org/blog/telegram-crypto-challenge/ 2) At this level of payout, they are inefficient and unsustainable. There were less expensive ways to discover implementation flaws, and certainly more direct ways to discover design flaws. Was the lesson they just learned really worth $100 grand from some random dude on the Internet? Seems to me you could find more problems per dollar by directly engaging with some of the top class security consultancies out there. So to summarize, telegram's reward was an extremely inefficient stunt that did not achieve it's likely real objective. I imagine the team is licking it's wounds right now and regretting their approach. We'll be able to tell by whether or not they continue their offer under the same rules and same budget. I expect this to continue for another couple of rounds because random security people on the Internet will be smelling blood right now.
- rdtsc 13y agoWell nice knowing you Telegram. I don't see a good way for them to recover from this. First the bogus contest that Moxie debunked. Now this. The best option is to close shop, open a new company, new names and do something else.
- sillysaurus2 13y agoThe best part is that the debunker wrote this in Russian. The language barrier has probably been responsible for them getting so many users. So now everyone is very clear that Telegram is snakeoil.
- danabramov 13y ago>The language barrier has probably been responsible for them getting so many users. What do you mean?
- Trufa 13y agoAs a side note, I didn't notice it was google translate until half way through the article. It's getting really good. Is Russian an "easy" language to translate to English?
- lukeqsee 13y agoI noticed it instantly (the title). I also noticed many irregularities throughout the article. I don't know if you're a native speaker, but to me it was obviously computer translated.
- Trufa 13y agoThe thing is, I though it was poorly written English, written by a non native speaker, rather than a computer. I must also clarify that I was a little distracted.
- mynameishere 13y agoI had to struggle to read it. I mean: After logout, one of the key interlocutors for chat will regenerate, and to check that I have the same key as the source, I can only look in his eyes phone. ...did it translate "iPhone" to "eyes phone"? I'm not sure. If that isn't what happened, then something far more horrible must have.
- Trufa 13y agoThe thing is, I though it was poorly written English, written by a non native speaker, rather than a computer. I must also clarify that I was a little distracted.
- 11001 13y agoThe original: После логаута одного из собеседников ключ для чата будет перегенерирован, а проверить то, что я имею тот же ключ что и собеседник я могу только посмотрев в его телефон глазами. My (human) translation: After one of the participants will log out, the key from the chat will be re-generated, but in order to check that I have the same key as them, I would need to see their phone with my own eyes. This sentence has a particularly non-English word order, plus some missed punctuation. I can see how it would be a hard case for machine translation.
- paveldurov 13y agoI'm excited by the insight and modesty of this guy. I will see to it that he gets a mighty prize. It's great to see how open software can leverage the power of the community to find weak spots and become stronger.
- yourad_io 13y agoHow much might a mighty prize be, if I may ask?
- lososerg 13y ago$100 000 http://vk.com/wall-52630202_7858 http://vk.com/wall-52630202_7858 Эта история заставляет в очередной раз восхититься российскими программистами. Целую неделю маститые американские криптографы на HackerNews безуспешно цеплялись к протоколу — в основном, с требованием заменить наше решение на алгоритмы, которые продвигает АНБ в своем Suite B. А российский программист, называющий себя "новичком", смог в рамках статьи на Хабре с ходу определить потенциально уязвимое место в секретных чатах. На всякий случай, поясню для массовых пользователей: утечки данных не было, уязвимость закрыта, опасности нет. Еще раз убедился в том, насколько правильным решением было полностью открывать протокол и исходный код. Это позволяет привлекать тысячи умных людей, которые могут помогать нам постоянно совершенствовать систему, находя потенциально уязвимые места. Разработчик, нашедший слабое место в нашем алгоритме, заслужил награду в $100,000. Подобную награду заслужит любой, кто найдет возможности схожей атаки (напоминаю, за расшифровку потока трафика мной была объявлена награда в $200,000). Продолжаем искать — вместе мы сделаем протокол нерушимым. This story makes us once again admire the Russian programmers . Whole week at the venerable American cryptographers HackerNews unsuccessfully clung to the protocol - mainly with our decision to replace the requirement for algorithms that promotes its NSA Suite B. A Russian programmer who calls himself a "newcomer " could under Article Habré stride identify potential vulnerabilities in secret chats . In any case , I will explain the bulk of users : data leakage was not a vulnerability is closed, there is no danger . Once again convinced of how the right decision was fully open protocol, and source code. This allows you to attract thousands of smart people who can help us to constantly improve the system by finding potential vulnerabilities . The developer, who found a weak spot in our algorithm , deserve a reward of $ 100,000 . Deserve such an award anyone who finds the possibility of similar attacks (remember, for decrypting traffic flow me was declared a reward of $ 200,000) . Continue to seek - together we will make a protocol indestructible .
- eliteraspberrie 13y agoGreat work! I hope this person gets a big piece of the prize, if not all of it. Perhaps they should have waited for the challenge to be expanded. (That's what I'm doing. I just hope nobody spills the beans first.)
- pjscott 13y agoThere's a lesson here. I genuinely don't mean to sound smug, but -- remember how confident the Telegram guys were? Remember how sure they were that their protocol would be able to resist the eavesdropping efforts of the NSA and whatever other nefarious interlopers may come along? Remember how they said they'd been working on it for years, and presumably expected for it to last many more years? Remember how that was, like, five days ago?
- onedev 13y agoNever forget. RIP Telegram (2013-2013). This whole thing has been interesting to follow because it seems this same thing happens every time someone make macho Crypto-claims. From seeing how confident the Telegram team was to reading all the detractors who were so ready to criticize. It's an interesting dynamic in the Crypto community.
- hawkharris 13y agoRIP Telegram (2013-2013) would make an interesting T-shirt. No one except a few cryptography buffs might understand it, but it would be a funny way to start conversations about information security.
- flux_w42 13y agoWould indeed be interesting to get to know some other cryptography-interetsted people on the bus, metro and other public places, so here you go: http://teespring.com/riptelegram http://teespring.com/riptelegram
- hawkharris 13y agoHaha. I love it!
- jlas 13y agoHN readers might also understand it.
- 13y ago
- 11001 13y agoHere are some of their comments: ibeatle Большое спасибо, автор поста полностью прав. Со своей стороны хотим пояснить, что сделано это было из лучших побуждений: исправление плохого рандома на клиентах. С настоящего момента в nonce всегда будет приходить ноль, и в следующем слое мы обязательно удалим это поле из схемы и поясним в документации. Автор топика безусловно заслужил награды, просьба обратиться хабраюзера x7mz на email support@telegram.org для уточнения деталей. Translation: Thanks very much, the author is absolutely correct. Just wanted to explain that the intentions were good: to correct bad "random" on the client side. From this point on nonce will always be set to 0, and next we will definitely remove it from our diagram and explanations in the docs. The author definitely deserves a prize, please enquire at the following email for details. W_K Товарищ прав — похоже, сервер в принципе может с помощью манипуляции с nonce выполнить MiTM на DH между клиентами. Не знаю, кто именно внедрил этот nonce в такой форме, хотя и знаю, какое предъявлялось обоснование — он был нужен для того, чтобы защититься от слабого рандома на клиентах, которых в принципе может писать кто угодно. Очевидно, нужно сделать этот nonce нулём и написать, что клиенты впредь не должны принимать секретные чаты с ненулевым nonce. Удивительно, что человек, называющий себя «чайником» в криптографии, нашёл действительно серьёзный недостаток протокола, в отличие от многих якобы «профессионалов», постоянно придирающихся не по существу. Не знаю как насчёт 200k$ — расшифровать трафик это не поможет, а сервер не знает ключа от секретного чата, поскольку на нём нет такой закладки. Но мне очень не нравится, что в будущем такая закладка могла бы быть в принципе кем-нибудь добавлена. Тем не менее, считаю, за это ценное наблюдение Вам положен ценный приз. Пусть и не такой большой. Если Вы или кто-либо ещё найдёт какие-либо ещё потенциальные дыры в протоколе — сообщайте, будем награждать. Translation: He is correct, looks like the server can manipulate nonce and succeed at MiTM on DH between the clients. Not sure who's idea it was to introduce that nonce in this form, but I do understand the motivation, to protect against the "weak random" on the clients that can in theory be written by anyone. Obviously, we need to make nonce=0 and refuse secret chats with non-zero nonce. It is quite amazing that the man who calls himself "a crypto noob" found a real vulnerability, as opposed to all those so-called professionals whose criticisms were largely unfounded. Not sure about the $200k since this vulnerability won't really help to decipher the traffic and the server doesn't know the key from the secret chat, because it doesn't have any "bookmark". But I really don't like that in the future such a bookmark could be added. However, I think this is a valuable observation and you do deserve a prize, even if not such a big one. If you, or anyone else, will find other potential vulnerabilities, please let us know, we will be rewarding.
- Aloha 13y agoWould this hole allow him to decrypt chat text?
- xytop 13y agono, but it allows server to decrypt it. Government in case of the need can "ask" them to forward your chat and they will do it, but it was stated in their PR that server is unable to decrypt your messages.
- rikacomet 13y agoexactly, the prize was at their own discretion(telegram) in the first place. And it was still for breaking their End-to-End encryption process. To simply put it, you don't have to break a wall, just find a loose brick, once that is gone, the wall will have even more loose bricks, and eventually it will fall.
- oddx 13y agoThis hole allows server (or somebody who can control connection between client and server) to read "encrypted" messages between clients.
- User1398 13y agoThis is great news for Telegram. With such a weakness, the NSA will soon be encouraging wide spread use of their protocol.
- sciguy77 13y agoAm I the only one who read this in my head with a Russian accent?
- rikacomet 13y agonope.. lol!
- gohrt 13y agoWhy is Telegram in the HNews so much? Are they part of the YC fraternity? Why do pay so much attention to crypto hucksters? It hasn't been so long since the last snake oil peddlers had their roasting -- I forget the name, it was some cutesy web-browser "secure" chat thing. It's cool to report debunkings, but if it weren't for HN, I (and most others?) never would have even seen these products in the first place.
- pgeorgi 13y agoI think the idea is that you get to see the product early so you can warn your activist friends (or your mom) when you happen to see them using it.
- frankzinger 13y ago"It hasn't been so long since the last snake oil peddlers had their roasting -- I forget the name, it was some cutesy web-browser "secure" chat thing." Cryptocat?
- DanBC 13y agoHN is (rightly) interested in easy to use secure software. So when something easy to use claims to be secure HN waits for some of the well known cryptographers here to kick the tires. In this case many people kicked the tires and pointed out some weird obvious flaws. People hoped that Telegram would listen, and seek help and advice, and continue to make a great product. Telegram's actions made the situation worse, and created a pile-on. Telegram made a few mistakes. 1) Smart people without crypto experience designed crypto software, but without getting involvement from cryptographers. 2) They released this product as finished, secure, ready to use. 3) They dismissed concerns. 4) To try to quash those concerns they created a rigged challenge with a high value prize. This is a well known red flag for cryptography software, and it's surprising they weren't aware of it, but as soon as people saw that the pile on accelerated.
- OoTheNigerian 13y agoThis is my first comment on the Telegram bruhaha. Sometimes, I get embarrassed by what I experience here on HN. The gang up, the unnecessary pride. To those saying RIP, Telegram will succeed. Without using it (I use a Blackberry), it looks to be top two of the chat apps when you combine usability/security. I will download it once I get an Android phone in January. I will not wish failure on anyone that is confident in his product. Of course they could have shown more humility but it he face of "take downs" on all sides especially the ones sponsored or initiated by the Whispersystem/Texsecure chaps, I do not see why they should have bowed down to be crushed. Considering the type of responses given by Pavel Durov, I am almost certain he would have been much more humble if his attackers toned it down a notch. To the person that found a flaw, kudos to you on doing something and not spending all your time doing take downs of telegram on HN threads and blogs. Pavel, I am hopeful that you will reward the chap even though the discovery was not within the "guidelines". it is all about the spirit of the competition. As for the TextSecure/WhisperSystems guys, stop being like the politicians we hate who campaign by slinging mud on opponents instead of selling their stuff. Focus on selling the TextSecure app and not looking to takeout anyone who has a different approach. PS: I have no relationship with either party. I am a neutral observer that has his own opinions.
- deleted 13y ago[deleted]
- DanBC 13y ago> To those saying RIP, Telegram will succeed. Without using it (I use a Blackberry), it looks to be top two of the chat apps when you combine usability/security. I will download it once I get an Android phone in January. But it is not secure! That's the entire point. Never mind "not secure against a well funded government agency", it's not secure against other attackers. There are lots of usable chat apps that do not give you the illusion of security. > and not looking to takeout anyone who has a different approach. You seem to be mistaken about why they do this. It's nothing to do with pushing their app or their approach. They'd welcome good well-formed apps to compete with them. But when they see an app that claims to be secure they have an ethical duty to let people know if it is obviously not secure. Most people are not bashing just for the sake of bashing. Some people need good cryptography software to avoid imprisonment, or torture, or state-killing. This isn't about stopping someone's teen-angsty poetry from being discovered by a sibling, it's about protecting political dissidents from an oppressive regime. In that context pointing out that a software is broken is not mindless bashing, it is a crucial part of the cryptography process. (I'll accept that a few people are missing the mark with their criticisms.) Pointing out flawed crypto software is part of a long tradition going back many years. It's part of the culture. Most cryptographer will start by analysing other software and finding flaws before implementing their own software.
- ateevchopra 13y agoThe first thing they teach in hacking class is "Nothing is 100% secure. Even the brain.exe is vunerable.".. Well proved again. Nice work !
- rikacomet 13y agoLol, I don't know whats so bad in Telegram being a bit "braggy" about their stuff. I mean, it took them a lot of hard work, in the first place since they did a lot of things on their own, instead of using pre-set standards. Everyone can loose a grip on self control, more than a few times. So what! Besides, its only to inspire someone to crack their program, it is necessary to come across as a bit arrogant, so someone would loose a screw and crack it. never mind the buttery language post-cracking, since that usually comes from appreciation for each other. Putting up a challenge publicly is a great PR tool, I feel its not reasonable to only bash 1 company about it. Unless, there is something I don't know, about what they said/did earlier on HN.
- deleted 13y ago[deleted]
- xternl 13y agoInteresting. I'm wondering about Threema, I think Moxie is already on them.
- jokoon 13y agoNoone should trust a service that advertises itself as being safe from governments ears. Pure and simple. First, there's a risk the NSA is actually the one initiating those services. Secondly, in cryptography, it's very hard if not impossible to effectively prove your messages are not read by someone else. Cryptography experts do not tend to work for people's interests. And if some do, the NSA has too many resources to just defeat those who try to not be listened to. I understand the intention is noble, but if you release such a safe tool, the NSA will view it as a terrorist threat, because that's the job they have been given, and they will end up listening anyways. I can't understand the paranoia about all this. If you're really afraid the NSA might use information against you, it's because you made political enemies, in this case, why use digital means of communication at all ? I really tend to think it's being cool to use those cryptographic features, rather than anything else, and that's worrying.
- solyanyk 13y agoThe Telegram guys chose to view it as a proof of inherent superiority of humble Russian programmers over NSA-backed American haters (I wish I was kidding!). Here is what Pavel Durov had to say on the matter (translated from his public post on vk.com http://vk.com/wall-52630202_7858 http://vk.com/wall-52630202_7858): > This story makes me once again admire Russian programmers. For a whole week esteemed American cryptographers on HackerNews were picking on the protocol fruitlessly - mostly demanding to replace our own solution with algorithms from NSA-backed Suite B [sic!]. An yet a Russian programmer, who calls himself "a novice", could immediately recognize the weak spot in the secret chats, in the context of an article on Habrahabr.ru. Edit: To make it clear, that is not the whole post, just the first paragraph relevant to my point
- ge0rg 13y agoNot sure if the VK post was edited later on, but you are missing the other important statements by Pavel: * There was no data leak, the vulnerability is fixed, there is no danger. * It was a good idea to open the source and protocol for review. * The founder of the vulnerability deserved a reward of $100k, and comparable rewards will be made for further attacks of similar grade.
- solyanyk 13y agoI didn't mean to present his whole post. It was the first statement that I had issue with. I amended my comment to make it clear.
- lawnchair_larry 13y agoThe bad thing about this is that it further advances the delusion that this contest is a reasonable idea. Nothing was "improved" by finding this. It's just going to reinforce their bad behavior.
- morj 13y agoThere is another "tab" for MITM (at least in android client and in the documentation there are no clues of it) : Even in the corrected version of Diffie-Hellman (with nonce removed) the server can slip customers a number which is zero modulo p as g_a or g_b (since the documentation says about the 2048- bit sequence -- it can be either 0 or p itself). Then both clients will see the same identicon ("visualization key", 'cause it will be a presentation of SHA1 applied to zero). However, judging by further manipulation with the "shared secret" key (because MTProto doesn't use Diffie-Hellman method of multiplying by g^ab^-1 or any multiplication by the shared key whatsoever) the multiplication by zero will not happen with client messages and they will successfully flow through the "bare" AES ( and therefore users will think that everything is fine and will proceed to transmitting sensitive data in this mode ). P. S.: Correct me if I missed something . This might be a corner case, but, nevertheless, it formally differs from the one with server xor salt not much (at least , need fixes in the client and the doc too). Or am I making a mistake somewhere? P. S.: Original version of this my comment in russian: http://habrahabr.ru/post/206900/#comment_7128970 http://habrahabr.ru/post/206900/#comment_7128970
- jokoon 13y agoNoone should trust a service that advertises itself as being safe from governments ears. Pure and simple. First, there's a risk the NSA is actually the one initiating those services. Secondly, in cryptography, it's very hard if not impossible to effectively prove your messages are not read by someone else. Cryptography experts do not tend to work for people's interests. And if some do, the NSA has too many resources to just defeat those who try to not be listened to. I understand the intention is noble, but if you release such a safe tool, the NSA will view it as a terrorist threat, because that's the job they have been given, and they will end up listening anyways. I can't understand the paranoia about all this. If you're really afraid the NSA might use information against you, it's because you made political enemies, in this case, why use digital means of communication at all ? I really tend to think it's being cool to use those cryptographic features, rather than anything else, and that's worrying.