Telegram protocol defeated. Authors are going to modify crypto-algorithm
translate.google.com
Telegram protocol defeated. Authors are going to modify crypto-algorithm
1–10 of 223 posts
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#2In short:
telegram in secure chats (http://core.telegram.org/api/end-to-end) was using modified version of Diffie-Hellman algorithm:
key = (pow(g_b, a) mod dh_prime) xor nonce
(original: key = pow(g_b, a) mod dh_prime)
That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed chats by request..
Authors of Telegram agreed that it is a big hole and their algorithm needs modification. User, who found the issue will get a prize (not 200,000$, but good enough).
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#3In short: telegram in secure chats ( http://core.telegram.org/api/end-to-end ) was using modified version of Diffie-Hellman algorithm: key = (pow(g_b, a) mod dh_prime) xor nonce (original: key = pow(g_b, a) mod dh_prime) That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed c…
Why not the 200K? Was it outside the parameters of the contest or something?
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#4In short: telegram in secure chats ( http://core.telegram.org/api/end-to-end ) was using modified version of Diffie-Hellman algorithm: key = (pow(g_b, a) mod dh_prime) xor nonce (original: key = pow(g_b, a) mod dh_prime) That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed c…
Why not the 200K? Was it outside the parameters of the contest or something?
Their contest had very restrictive parameters if I recall correctly.
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#5In short: telegram in secure chats ( http://core.telegram.org/api/end-to-end ) was using modified version of Diffie-Hellman algorithm: key = (pow(g_b, a) mod dh_prime) xor nonce (original: key = pow(g_b, a) mod dh_prime) That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed c…
Why not the 200K? Was it outside the parameters of the contest or something?
Yes. The contest is not about actually exposing flaws in their cryptosystem, which is why the rules are rigged up in a way that would allow even a terribly insecure protocol (like Telegram's, or Moxie's counter-challenge protocol) to pass as "secure".
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#6In short: telegram in secure chats ( http://core.telegram.org/api/end-to-end ) was using modified version of Diffie-Hellman algorithm: key = (pow(g_b, a) mod dh_prime) xor nonce (original: key = pow(g_b, a) mod dh_prime) That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed c…
Why not the 200K? Was it outside the parameters of the contest or something?
Yes, outside.
Although the underground of this contest was to prove security and inability to read messages by 3rd parties
contest was about decrypting Durov's chat. Chat is not decrypted and as many say - it's nearly impossible (http://thoughtcrime.org/blog/telegram-crypto-challenge/).
But "bookmark" is found and it means that all the PR was shit.
Telegram already removed 'xor nonce' from their documentation and added a new layer to their api but who knows where they will put a next bookmark. Probably it will be hidden in a deeper place. But trust is already lost.
It appears that either their secure protocol was containing the bookmark specially or that protocol is getting written by non-specialists which cant guarantee any security.
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#7In short: telegram in secure chats ( http://core.telegram.org/api/end-to-end ) was using modified version of Diffie-Hellman algorithm: key = (pow(g_b, a) mod dh_prime) xor nonce (original: key = pow(g_b, a) mod dh_prime) That custom 'nonce' is derived from server and in theory server can send a specially formed nonce which will lead to known client keys ("bookmark"). It means that server as MITM can read all needed c…
Why not the 200K? Was it outside the parameters of the contest or something?
Their contest was based on a sample packet capture only.
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#8Earlier quoted context omitted.
Why not the 200K? Was it outside the parameters of the contest or something?
Yes. The contest is not about actually exposing flaws in their cryptosystem, which is why the rules are rigged up in a way that would allow even a terribly insecure protocol (like Telegram's, or Moxie's counter-challenge protocol) to pass as "secure".
Telegram's contest itself is meaningless regarding the security of its protocol (as others explained in details). Finding bugs such as this deserves 200k more than anything else
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#9So this was supposed to be secure/robust/mature/trustworthy ? Not impressed, still too many companies around pretending it's sooo easy to make something better, how hard can it be ?
Re: Telegram protocol defeated. Authors are going to modify crypto-algorithm
#10200k gone just like that, better now then later.