Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom rolled their own encryption scheme, transmit keys through servers in China

citizenlab.ca

Post reply on HN
Print view View original

41–50 of 316 posts

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#41

Post by api »

Why can't people bother to construct a minimally secure encryption system given that there are so many good documents and code examples out there?

I don't mean anything with ratcheting, forward secrecy, replay protection, nonce reuse resistance, or any other bells and whistles, just basic competent symmetric encryption without gaping holes or ridiculous bizarre design choices?

It's not hard!

(1) Generate 12 bytes of random nonce using a good secure random source, prepend to message.

(2) Use nonce to initialize AES-GCM.

(3) Run it through AES-GCM, append tag.

(4) Done.

That's not hard and it's secure enough for common use cases.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#42

Post by miked85 »

rzimmerman wrote: post #36
kop316 wrote: post #30

Earlier quoted context omitted.

> Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. ...you're joking right? The Wikipedia example for why ECB is not recommended is literally an image: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operat…

It's definitely a terrible choice for uncompressed images or video. I'm arguing it probably isn't that bad for highly compressed video. That being said, if you're encrypting any data stream you should use an appropriate stream cipher.

If the encryption scheme is poor, why would the data being compressed or not matter?

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#45

Post by nostrademons »

013a wrote: post #10

> Zoom’s most recent SEC filing shows that the company (through its Chinese affiliates) employs at least 700 employees in China that work in “research and development.” Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?

Zoom's core product development is in China. Their Bay Area office is apparently support roles.

700 engineers for a software company the size of Zoom is actually pretty small.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#46

Post by saagarjha »

songshuu wrote: post #40
dmitrygr wrote: post #34

Earlier quoted context omitted.

The article is quite direct: key directly sent to client in USA directly from a server in china. what is unclear?

Have read the whole article myself, I did not see that explicitly stated. Could you provide the quote?

> In addition, we identify potential areas of concern in Zoom’s infrastructure, including observing the transmission of meeting encryption keys through China.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#48

Post by thedudeabides5 »

jasonv wrote: post #3
gen3 wrote: post #2

This is honestly the best “Zoom is bad” summery I’ve seen so far. While I certainly believe some of the Zoom hate is blown out of proportion, this article does a good job explaining to someone who isn't a security expert what the issues are. I've been getting questions about the company from family and friends, and will be forwarding this to them. Well done.

I think of it as a warning to future companies who take these kind of liberties...

I mean, isn't this stuff they can fix?

Like good that the market is stressing them on their security, at $30bn they should be able to engage with that feedback and then loop.

On the other hand, tried to use Skype lately? Product has barely evolved since they were bought out by MSFT.

Guess google does videoconferencing too, but they know enough about us all already....

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#49

Post by Enginerrrd »

wrs wrote: post #20
NikolaeVarius wrote: post #11

I really don't think this counts as rolling your own crypto. They just used a weak implementation of existing methods. No more rolling your own crypto than if I were to use DES.

It's "rolling your own crypto ", not "rolling your own encryption algorithm". That includes using "secure" low-level primitives incorrectly to build an insecure higher-level protocol. In this case, using ECB mode has been known for years (decades?) to be a bad move regardless of the underlying encryption algorithm. As the classic article says, if you type the letters A-E-S, you're doing it wrong.

Yeah, in fact, that is USUALLY the way people screw up and roll their own crypto.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#50

Post by fennecfoxen »

miked85 wrote: post #42
rzimmerman wrote: post #36

Earlier quoted context omitted.

It's definitely a terrible choice for uncompressed images or video. I'm arguing it probably isn't that bad for highly compressed video. That being said, if you're encrypting any data stream you should use an appropriate stream cipher.

If the encryption scheme is poor, why would the data being compressed or not matter?

"The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption."
Post reply on HN