Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram’s Cryptanalysis Contest

cryptofails.com

Post reply on HN
Print view View original

111–120 of 138 posts

Re: Telegram’s Cryptanalysis Contest

#111

Post by StavrosK »

Nursie wrote: post #70
TelegramApp wrote: post #52

The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (see contest FAQ: http://core.telegram.org/contestfaq ). Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to ch…

>> > they are trying to do “Mac and Encrypt” which is not secure. >> We are not doing this. We are doing this: http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the... . Right, but you still include the sha-1 of the plaintext in your outgoing message, which is (IIRC) generally considered bad practice because it leaks information about the plaintext.

The idea of cryptographic hashes is that they don't leak information about the plaintext, though.

Re: Telegram’s Cryptanalysis Contest

#112

Post by StavrosK »

paveldurov wrote: post #110
tptacek wrote: post #104

Earlier quoted context omitted.

You can't simply use CBC without a MAC either. The generic composition of CBC with HMAC and randomized explicit IVs is strong assuming you've dealt with side channels. But a modern cryptosystem wouldn't use CBC either; it would use a AEAD mode, like AES-GCM or AES-OCB. A very, very modern system would use a native stream cipher like Salsa20 and a polynomial MAC like UMAC or GMAC or Poly1305. No cryptosystem in the wo…

> But a modern cryptosystem ... would use a AEAD mode, like AES-GCM But really, it is funny how rigidly you stick to NSA Suite B Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography That, your fierce battle against everything unconventional and the fact that you get emotional instead of actually proving your point makes me think some "best practices" are indeed intentionally promoted in the crypto-commu…

Because, with cryptography, the onus is on you to prove that your system is secure, not on other people to prove that it is broken. Everyone tells you there are many hints that your system is not secure, and you just go "well you can't prove it isn't, so there".

Re: Telegram’s Cryptanalysis Contest

#113

Post by velis_vel »

StavrosK wrote: post #111
Nursie wrote: post #70

Earlier quoted context omitted.

>> > they are trying to do “Mac and Encrypt” which is not secure. >> We are not doing this. We are doing this: http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the... . Right, but you still include the sha-1 of the plaintext in your outgoing message, which is (IIRC) generally considered bad practice because it leaks information about the plaintext.

The idea of cryptographic hashes is that they don't leak information about the plaintext, though.

No, that's incorrect. A hash function should have these properties:

* Given a hash h it should be hard to find a message m such that hash(m) = h

* Given a mesage m1 it should be hard to find m2 such that hash(m1) = hash(m2)

* It should be hard to find any two messages m1 and m2 such that hash(m1) = hash(m2)

If you have some secure hash function h, the function h'(m) that appends the low byte of m to h(m) is still secure under all three properties, but it obviously leaks information.

Re: Telegram’s Cryptanalysis Contest

#114

Post by StavrosK »

seertaak wrote: post #56
tptacek wrote: post #49

Earlier quoted context omitted.

That would be nice. But, for what it's worth: don't use Telegram. It's a mess. TextSecure was built much, much more carefully.

Is TextSecure only for SMS messages, or does it use the internet? I'm asking because of the need to send text messages abroad (at a reasonable price). Also, is there a desktop client for TextSecure? I would love something like WhatsApp -- but secure and with a desktop client.

Depending on how much you're willing to pay, Silent Circle might fit the bill: https://silentcircle.com/

Disclaimer: I work for them.

Re: Telegram’s Cryptanalysis Contest

#115

Post by cheald »

utnick wrote: post #63

If the crypto is broken, then break the crypto and collect the 200k. Or if its vulnerable to a MITM, then explain how. Or if its vulnerable to chosen plaintext/ciphertext or known plaintest, explain how. There has been so much piling on of telegram, but nobody has actually proven any problems with their code or protocol. Meanwhile telegram is trying to do the right thing by being open source and taking the time to re…

The contest is framed in such a way that the protocol's weaknesses aren't exposed to attack in the way that they would be in the wild.

Re: Telegram’s Cryptanalysis Contest

#116

Post by jaxb »

paveldurov wrote: post #110
tptacek wrote: post #104

Earlier quoted context omitted.

You can't simply use CBC without a MAC either. The generic composition of CBC with HMAC and randomized explicit IVs is strong assuming you've dealt with side channels. But a modern cryptosystem wouldn't use CBC either; it would use a AEAD mode, like AES-GCM or AES-OCB. A very, very modern system would use a native stream cipher like Salsa20 and a polynomial MAC like UMAC or GMAC or Poly1305. No cryptosystem in the wo…

> But a modern cryptosystem ... would use a AEAD mode, like AES-GCM But really, it is funny how rigidly you stick to NSA Suite B Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography That, your fierce battle against everything unconventional and the fact that you get emotional instead of actually proving your point makes me think some "best practices" are indeed intentionally promoted in the crypto-commu…

Do you truly need to ad-hominem attack tptacek? You sound pretty much like pseudoscientists when they blame mainstream science being too rigid and not accepting their groundbreaking theories.

Re: Telegram’s Cryptanalysis Contest

#117

Post by StavrosK »

velis_vel wrote: post #113
StavrosK wrote: post #111

Earlier quoted context omitted.

The idea of cryptographic hashes is that they don't leak information about the plaintext, though.

No, that's incorrect. A hash function should have these properties: * Given a hash h it should be hard to find a message m such that hash(m) = h * Given a mesage m1 it should be hard to find m2 such that hash(m1) = hash(m2) * It should be hard to find any two messages m1 and m2 such that hash(m1) = hash(m2) If you have some secure hash function h, the function h'(m) that appends the low byte of m to h(m) is still sec…

Hmm, I unfortunately can't remember the hash attack models right now, but you may be right. I think there are models under which this fails, though.

Re: Telegram’s Cryptanalysis Contest

#118

Post by ash »

Nursie wrote: post #62
vitalyny wrote: post #48

Earlier quoted context omitted.

Oh, wow, and people complain about Telegram team's attitude. Don't be so vulnerable, please. Take the critics easy. As for the article, it's well written, but most of the points had been answered in Telegram FAQ or comments on HN. And yet they come up again and again. Not all, most.

>> Oh, wow, and people complain about Telegram team's attitude. Don't be so vulnerable, please. Take the critics easy. I'm not sure what you mean by this as I'm not the author, so you haven't criticised anything I've said. >> As for the article, it's well written, but most of the points had been answered in Telegram FAQ or comments on HN. And yet they come up again and again. Not all, most. Not adequately, hence the…

I think Telegram "cheerleaders" are here because Telegram backer Pavel Durov (paveldurov on HN) is very well known in Russia. He is the founder of one of most popular social networks in Russia, vk.com. He is a (local?) celebrity and he has fans. Imagine Mark Zuckerberg backing Telegram.

Re: Telegram’s Cryptanalysis Contest

#119

Post by trycatch »

Nursie wrote: post #62
vitalyny wrote: post #48

Earlier quoted context omitted.

Oh, wow, and people complain about Telegram team's attitude. Don't be so vulnerable, please. Take the critics easy. As for the article, it's well written, but most of the points had been answered in Telegram FAQ or comments on HN. And yet they come up again and again. Not all, most.

>> Oh, wow, and people complain about Telegram team's attitude. Don't be so vulnerable, please. Take the critics easy. I'm not sure what you mean by this as I'm not the author, so you haven't criticised anything I've said. >> As for the article, it's well written, but most of the points had been answered in Telegram FAQ or comments on HN. And yet they come up again and again. Not all, most. Not adequately, hence the…

> I'm going to echo what I've seen in another post - you appear to be a Telegram cheerleader with a brand new account, are you associated with them at all?

Discussions on HN about Telegram were mentioned on several Russian sites (e.g. [1]). No wonder that some persons decided to pitch in.

[1] http://www.siliconrus.com/2013/12/telegram-vs-hacker-news/ Approximate translation: "How experts on Hacker News laughed at Telegram."

Re: Telegram’s Cryptanalysis Contest

#120

Post by paveldurov »

jaxb wrote: post #116
paveldurov wrote: post #110

Earlier quoted context omitted.

> But a modern cryptosystem ... would use a AEAD mode, like AES-GCM But really, it is funny how rigidly you stick to NSA Suite B Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography That, your fierce battle against everything unconventional and the fact that you get emotional instead of actually proving your point makes me think some "best practices" are indeed intentionally promoted in the crypto-commu…

Do you truly need to ad-hominem attack tptacek? You sound pretty much like pseudoscientists when they blame mainstream science being too rigid and not accepting their groundbreaking theories.

Scientific approach is exactly what I'm calling for here. When a cryptographer resorts to arguments like "this algorithm won't work because it is not common/modern/accepted" without providing an exact way to break it, it doesn't sound like scientific approach to me. It's more like the religious mindset of someone who rigidly worships some limited list of tools (e.g. "NSA Suite B Cryptography") and punishes anyone who is independent enough to deviate from it.
Post reply on HN