91–100 of 176 posts
The problem with this test is that there are many encryption systems I would consider fundamentally broken where I could not claim this prize. To make this a slightly fair challenge, we should at least be allowed to get the clear text of our choice also encrypted with the same key.
Earlier quoted context omitted.
Agreed, but the tone of the previous discussion was definitely more along the lines of "This could never work, you guys don't know what you're doing." If it proves resilient over 2.5 months of highly motivated attacks (motivated by both the money / "I-Told-You-So" factor), I think that's a fairly strong statement in their favor.
i have a day job and i'm not going to drop everything for the chance i won't make any money at all... told-you-so factor or not.
If they just encrypted their communications with AES-128 in ECB mode with a fixed random secret key, the challenge could not be won. And that's not even semantically secure. So we will learn absolutely nothing about the security of their software from the results of this challenge. Whoever designed this challenge is either extremely dishonest or knows nothing about cryptography.
If they really want to improve their software, they should offer a $200,000 bounty for a proof of concept implementation of an attack within their threat model.
Edit: I originally started this post with "...probably designed to get press rather than to actually improve the software...", which I have removed, since I have no evidence to support the claim.
The problem with this test is that there are many encryption systems I would consider fundamentally broken where I could not claim this prize. To make this a slightly fair challenge, we should at least be allowed to get the clear text of our choice also encrypted with the same key.
I understand they reveal the algorithm so you should be able to encrypt any text of your choice if that helps.
> 100% FREE & NO ADS: Telegram is free and will always be free. We do not plan to sell ads or introduce subscription fees. how you are then going to make a money ?
Cryptography Snake Oil Warning Sign #9: Cracking contests. https://www.schneier.com/crypto-gram-9902.html (1999)
Our Twofish cryptanalysis contest offers a $10K prize for the best negative comments on Twofish that aren't written by the authors. There are no arbitrary definitions of what a winning analysis is. There is no ciphertext to break or keys to recover. We are simply rewarding the most successful cryptanalysis research result, whatever it may be and however successful it is (or is not). Again, the contest is fair because…
From what I've seen, they use something called the "Axolotl Ratchet", developed by Trevor Perrin. A quick search of his name didn't yield any crypto papers / research by him.
Also, you write "and has been studied in detail for years"
There are no links/references to code/protocol reviews in the WhisperSystems website.
Again, I have the utmost respect for their research, it's just that from the side of a non-crypto-versed user/coder, Telegram and TextSecure look the same.
Earlier quoted context omitted.
We already know the system is hopelessly vulnerable to server side MITM attacks, it makes no effort to defend against that attack model. It's mentioned in the comments that they might do manual key verification in the future, but that doesn't happen now. Compromise is silent.
Is that really the case? Would you mind linking to that? Because if that's true, then this contest is dangerously misleading.
Earlier quoted context omitted.
Our Twofish cryptanalysis contest offers a $10K prize for the best negative comments on Twofish that aren't written by the authors. There are no arbitrary definitions of what a winning analysis is. There is no ciphertext to break or keys to recover. We are simply rewarding the most successful cryptanalysis research result, whatever it may be and however successful it is (or is not). Again, the contest is fair because…
Moxie is a great researcher and WhisperSystems seem serious. However, I don't understand why you claim that TextSecure is designed by cryptographers. From what I've seen, they use something called the "Axolotl Ratchet", developed by Trevor Perrin. A quick search of his name didn't yield any crypto papers / research by him. Also, you write " and has been studied in detail for years " There are no links/references to c…
Here are some resources:
https://www.hnsearch.com/search#request/all&q=by%3Atptacek+t...
Cryptography Snake Oil Warning Sign #9: Cracking contests. https://www.schneier.com/crypto-gram-9902.html (1999)
From that page: > [...] the contest is fair because 1) the algorithm is completely specified, 2) there are no arbitrary definition of what winning means, and 3) the algorithm is public domain
