Telegram - secure, free messaging

Post by TelegramApp » Thu, Dec 19, 2013, 11:50 AM UTC

nialo wrote: post #191

tptacek wrote: post #182

Earlier quoted context omitted.

I believe they are using SHA1 with IGE mode, giving each message a trailer that is the SHA1 hash of the message.

Disclaimer: I am not a cryptographer, and have only gotten to #40 in Matasano's challenges. They appear to be trying to use encrypt and mac, and not as far as I can tell relying on IGE mode to provide authentication. See the "Message Key" and "Important Tests" sections here: https://core.telegram.org/mtproto/description There is also not, as far as I can tell from reading the protocol description above and the source…

Post by notdang » Thu, Dec 19, 2013, 4:23 PM UTC

umrath wrote: post #222

sneak wrote: post #193

Earlier quoted context omitted.

> That is correct, Telegram does upload names and numbers Ugh, this is such douchebag behavior for something that purports to be a "secure" app. Stop it immediately, please.

Just read the rights dialog instead of clicking "ok" and deny that right. Problem solved!

Post by liliakai » Thu, Dec 19, 2013, 6:45 PM UTC

TelegramApp wrote: post #160

moxie wrote: post #141

The reason that cryptographers laugh at people who advertise "military grade cryptography" or "we use AES256" is because the choice of crypto primitives is often less important than how they're composed. Those phrases tend to reflect a critical misunderstanding of that, and often mean that a project is using secure primitives in a way that completely undermines their security. At a glance, while this project is using…

Two questions for you: 1. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know. 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. Thank you fo…

Post by jackmaney » Fri, Dec 20, 2013, 4:13 PM UTC

TelegramApp wrote: post #160

moxie wrote: post #141

The reason that cryptographers laugh at people who advertise "military grade cryptography" or "we use AES256" is because the choice of crypto primitives is often less important than how they're composed. Those phrases tend to reflect a critical misunderstanding of that, and often mean that a project is using secure primitives in a way that completely undermines their security. At a glance, while this project is using…

Two questions for you: 1. Kindly be more specific about our RSA implementation. Please note, that we only use RSA with public keys, not private. If you are aware of any possible attacks on this setup, please let us know. 2. And what problems with IGE are you aware of? Any known attack? As far as we know, it is the ubiquitous CBC that has had issues. And by the way, Kerberos had to abandon PCBC - not IGE. Thank you fo…

Post by phaus » Sat, Dec 21, 2013, 5:04 AM UTC

TelegramApp wrote: post #162

huhtenberg wrote: post #161

Earlier quoted context omitted.

> this protocol is the result of thougtful and prolonged work of professionals. Pray tell, why replay protection is done after decryption.

In terms of DoS possibilities, one doesn't need to replay old messages, they could just as easily send new ones or random garbage. We could employ additional filtering techniques, but that increases processing time. And since modern hardware allows for very fast AES decryption, there is no particular gain in building additional layers of protection. All that, naturally, implies that other anti-DoS measures are also b…