Telegram’s Cryptanalysis Contest
cryptofails.com
Telegram’s Cryptanalysis Contest
1–10 of 138 posts
Re: Telegram’s Cryptanalysis Contest
#2I wish there was an article that succinctly conveys to potential users why Telegram is snakeoil and why TextSecure is the real deal.
Re: Telegram’s Cryptanalysis Contest
#3With all the publicity TextSecure is getting from all this Telegram Debacle, I am beginning to suspect telegram isn't even a real company, and just a very elaborate publicity stunt by Moxie and the rest of the TextSecure team!! :P
Re: Telegram’s Cryptanalysis Contest
#4> They use the broken SHA1 hash function
They answer this point on the website: "Q: Why do you use SHA-1 in the place of a MAC? [...] since this means still requiring at least 2^128 operations (instead of 2^256 with, say, SHA-2) to even begin trying to break this scheme, the trade-off seems fair."
Why not break the crypto (and take the money) if it's so amateurish?
Re: Telegram’s Cryptanalysis Contest
#5> They use the broken SHA1 hash function They answer this point on the website: "Q: Why do you use SHA-1 in the place of a MAC? [...] since this means still requiring at least 2^128 operations (instead of 2^256 with, say, SHA-2) to even begin trying to break this scheme, the trade-off seems fair." Why not break the crypto (and take the money) if it's so amateurish?
The easiest to understand response to this question that I've seen so far is from this comment [0]:
The contest limitations rule out most of the likely attack vectors for breaking the protocol in the real world. It's like saying "Our bank vans are 100% secure. Just try stealing money from them without puncturing our tires or bribing one of our employees."
Re: Telegram’s Cryptanalysis Contest
#6> They use the broken SHA1 hash function They answer this point on the website: "Q: Why do you use SHA-1 in the place of a MAC? [...] since this means still requiring at least 2^128 operations (instead of 2^256 with, say, SHA-2) to even begin trying to break this scheme, the trade-off seems fair." Why not break the crypto (and take the money) if it's so amateurish?
The easiest to understand response to this question that I've seen so far is from this comment [0]: The contest limitations rule out most of the likely attack vectors for breaking the protocol in the real world. It's like saying "Our bank vans are 100% secure. Just try stealing money from them without puncturing our tires or bribing one of our employees." [0] - https://news.ycombinator.com/item?id=6936949
In particular none of the attacks described in TFA (Known Plaintext, Chosen Plaintext and Chosen Ciphertext) are possible within the frame of their contest (since Telegram controls all inputs).
Yesterday someone blogged an example of a completely broken cryptosystem that would still pass Telegram's challenge with the same limitations: http://www.thoughtcrime.org/blog/telegram-crypto-challenge/
Re: Telegram’s Cryptanalysis Contest
#7> They use the broken SHA1 hash function They answer this point on the website: "Q: Why do you use SHA-1 in the place of a MAC? [...] since this means still requiring at least 2^128 operations (instead of 2^256 with, say, SHA-2) to even begin trying to break this scheme, the trade-off seems fair." Why not break the crypto (and take the money) if it's so amateurish?
[deleted]
Re: Telegram’s Cryptanalysis Contest
#8Funny how they say "oh but the attack possibilities are limited" then proceed to mention all the weaknesses in the algorithm.
Well, if the algorithm is so broken then it should be trivial to break it even with their limitations.
Isn't that what they say? "Oh SHA-1 is broken", great, show it.
Of course, the capability to do that may be worth more than getting the $200k from the contest
Re: Telegram’s Cryptanalysis Contest
#9Earlier quoted context omitted.
The easiest to understand response to this question that I've seen so far is from this comment [0]: The contest limitations rule out most of the likely attack vectors for breaking the protocol in the real world. It's like saying "Our bank vans are 100% secure. Just try stealing money from them without puncturing our tires or bribing one of our employees." [0] - https://news.ycombinator.com/item?id=6936949
In particular none of the attacks described in TFA (Known Plaintext, Chosen Plaintext and Chosen Ciphertext) are possible within the frame of their contest (since Telegram controls all inputs). Yesterday someone blogged an example of a completely broken cryptosystem that would still pass Telegram's challenge with the same limitations: http://www.thoughtcrime.org/blog/telegram-crypto-challenge/
That's Moxie Marlinspike, developer of TextSecure.
Re: Telegram’s Cryptanalysis Contest
#10Forgetting the discussion of the merits or otherwise of Telegram - I just wanted to say that that is a very written article. A clear argument built on clear explanations of the various models.