Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram - secure, free messaging

telegram.org

Post reply on HN
Print view View original

171–180 of 231 posts

Re: Telegram - secure, free messaging

#171

Post by tptacek »

TelegramApp wrote: post #160
moxie wrote: post #141

The reason that cryptographers laugh at people who advertise "military grade cryptography" or "we use AES256" is because the choice of crypto primitives is often less important than how they're composed. Those phrases tend to reflect a critical misunderstanding of that, and often mean that a project is using secure primitives in a way that completely undermines their security. At a glance, while this project is using…

Two questions for you: 1. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know. 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. Thank you fo…

What's the message format you're using for RSA? I see RSA in the "pq" code of your Java client library; I see you asking Java for an "unpadded" instance of the RSA encryptor; I see you using RSA in its encrypting operation (not signing).

Great crypto software avoids RSA. Good crypto software uses OAEP when RSA is used to encrypt. Crappy crypto software (see: DNSSEC) uses PKCS1v1.5. What are you using?

I didn't look carefully; I have probably missed something. Please explain how you are using RSA in the handshake/authentication for your protocol. Like Moxie said: it's not the underlying algorithms you use; it's the constructions you use to to them together, and to the data you're protecting.

Incidentally, "I refuse to respond to comments from people who have only looked at my system for a couple minutes" is not a habit of highly effective cryptographers.

Re: Telegram - secure, free messaging

#173

Post by tptacek »

moxie wrote: post #164
TelegramApp wrote: post #160

Earlier quoted context omitted.

Two questions for you: 1. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know. 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. Thank you fo…

> 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. IGE was the first attempt at an "authenticating encryption mode," originally for Kerberos. It was a failed attempt (it does not provide integrity protection), and had to be removed. That was the beginning of a 20 year quest for an…

Regarding IGE: Gligor and Donescu, 1999; a summary on a mailing list of the attack:

https://groups.google.com/forum/#!topic/sci.crypt/4bkzm_n7UG...

Long story short: you get integrity protection from IGE by relying on the fact that a bit error anywhere in the stream will irrevocably corrupt the rest of the stream, so you create an authentication code by sticking an all-zeroes block or (like I think Telegram does) a message digest to the end of the stream.

But it's possible with carefully chosen errors to first corrupt an IGE stream and then recover it, so that the remainder of the message after the corruption (including the "MAC" tag) will remain intact.

IGE is an extremely weird, and, at this point I'll venture: bad choice for a 2013-2014 cryptosystem.

Re: Telegram - secure, free messaging

#174

Post by tptacek »

TelegramApp wrote: post #138
na85 wrote: post #7

From their FAQ: > Q: How secure is Telegram? > Very secure. We are based on a new protocol, MTProto, built by our own specialists from scratch, with security in mind. At this moment, the biggest security threat to your Telegram messages is your mother reading over your shoulder. We took care of the rest. Oh good, a bunch of randoms have rolled their own crypto. I stopped reading at this point.

We have not 'rolled our own crypto'. We still use RSA, AES and DH. I've changed the part in the FAQ that seems to be one of major sources of this controversy, so that it no longer reads "built from scratch". This was poorly applied marketing language — we do use time-tested security algorithms. Even though Telegram doesn't uses MTProto instead of HTTPS due to mobile speed and trust issues.

RSA in what mode?

AES in what mode? IGE? Why are you using an authenticated cipher mode from the 1970s that predates every modern AEAD construction?

DH with what group? How do you authenticate the exchange? How does forward secrecy work?

Saying "we didn't roll our own: we use RSA, AES, and DH" is extremely worrying; it suggests that you're not aware of where the complexity in a cryptosystem lives. Anybody on HN can write the trivial code to ask the JCE for an RSA or an AES. You have to do better.

Re: Telegram - secure, free messaging

#175

Post by ska »

TelegramApp wrote: post #143
ge0rg wrote: post #101

Earlier quoted context omitted.

It is a really bad idea to compromise security for speed and connection stability. Processing power is a question of scaling the hardware, communication speed is hardly affected by a proper encryption scheme, neither is reliability of the application-layer protocol. Usability, however, is a different beast. You must compromise security to make a chat application appeal to "regular" users. Still, this is a trade-off t…

MTProto still uses RSA, AES + DH. So I would disagree that what we have here means 'compromising security for speed and stability'. It is rather optimizing for speed and stability, while staying secure.

Often in the crypto world, these are exactly the good intentions with which the road to hell(pwnage?) is paved.

Knowing this, I hope you can appreciate why the burden of proof on your unproven team and approach is fairly high.

Re: Telegram - secure, free messaging

#176

Post by ash »

digitalengineer wrote: post #50
sillysaurus2 wrote: post #33

Earlier quoted context omitted.

He's done nothing in crypto, and he's rolled his own protocol. That's historically been recipe for disaster regardless of how many honors you hold. Colin Percival is similarly decorated, along with being a cryptographer (he's the FreeBSD security officer): http://www.daemonology.net/papers/ ... yet even his crypto app Tarsnap was broken for over a year before he noticed, due to a typo during an innocent-looking refac…

To bad there's no iOS app.

It looks like they are working on it:

https://github.com/WhisperSystems/TextSecure-iOS

Re: Telegram - secure, free messaging

#177

Post by TelegramApp »

tptacek wrote: post #171
TelegramApp wrote: post #160

Earlier quoted context omitted.

Two questions for you: 1. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know. 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. Thank you fo…

What's the message format you're using for RSA? I see RSA in the "pq" code of your Java client library; I see you asking Java for an "unpadded" instance of the RSA encryptor; I see you using RSA in its encrypting operation (not signing). Great crypto software avoids RSA. Good crypto software uses OAEP when RSA is used to encrypt. Crappy crypto software (see: DNSSEC) uses PKCS1v1.5. What are you using? I didn't look c…

This version of the client is using manual padding with random bytes. This isn't too bad, considering the SHA1 presence. (See #4 here: https://core.telegram.org/mtproto/auth_key)

The server now supports OAEP, although this has yet to find its way into the docs and clients. We will update. Thank you!

Re: Telegram - secure, free messaging

#178

Post by TelegramApp »

tptacek wrote: post #173
moxie wrote: post #164

Earlier quoted context omitted.

> 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. IGE was the first attempt at an "authenticating encryption mode," originally for Kerberos. It was a failed attempt (it does not provide integrity protection), and had to be removed. That was the beginning of a 20 year quest for an…

Regarding IGE: Gligor and Donescu, 1999; a summary on a mailing list of the attack: https://groups.google.com/forum/#!topic/sci.crypt/4bkzm_n7UG... Long story short: you get integrity protection from IGE by relying on the fact that a bit error anywhere in the stream will irrevocably corrupt the rest of the stream, so you create an authentication code by sticking an all-zeroes block or (like I think Telegram does) a m…

We use SHA1 (see 'message key' here: https://core.telegram.org/mtproto/description). IGE is used instead of CBC.

Re: Telegram - secure, free messaging

#179

Post by ge0rg »

ohwp wrote: post #166
ge0rg wrote: post #135

Earlier quoted context omitted.

naturally, after receiving permission to do so. This is not quite true. I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services. You can not actually imply that permission from all contacts merely by asking the user. this also enables us to use proper names in notifications on the iPhone I do not know enough about the iOS internals, but…

"I never gave anyone (especially not the users of WhatsApp or Telegram) permission to upload my personal information to any cloud services." On Android you do by granting rights to access your contacts and give full network permissions. So you never know what a program will do with your contacts and a network connection.

But in the real world,your contacts never told you "feel free to upload my name and all my phone numbers wherever you want, so we can be linked by some cloud service to improve their click-through rates". An app that uploads your contacts is violating the privacy of your friends, even if it asks you about it.

Re: Telegram - secure, free messaging

#180

Post by andor »

Tepix wrote: post #159
andor wrote: post #16

Like Threema, they use the PGP model, instead of OTR...

What do you mean exactly? According to the FAQ, Threema offers perfect forward secrecy: Yes, Threema provides forward secrecy on the network connection. Client and server negotiate temporary random keys, which are only stored in RAM and replaced every time the app restarts (and at least once every 7 days). An attacker who has captured the network traffic will not be able to decrypt it even if he finds out the long-te…

Oh, I thought Threema crypto is based on RSA+DH, but according to the FAQ they use the NaCl library. That's quite nice!
Post reply on HN