Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram’s Cryptanalysis Contest

cryptofails.com

Post reply on HN
Print view View original

51–60 of 138 posts

Re: Telegram’s Cryptanalysis Contest

#51

Post by vitalyny »

peteretep wrote: post #22
venomsnake wrote: post #20

Is there a reason why all fad "secure" products lately default to custom protocols and exotic solutions instead of using well tested and trusted solutions? Designing a protocol so that is does not leak is very hard.

Unique Selling Point

WhatsApp already does everything that messenger should do - send text, images, video, files, location, group chats. The only thing that's not yet there is super-fast speed and security - and those are Telegram's priorities. They will get feedback from crypto community and update their protocols, they definitely have a potential to do it.

Re: Telegram’s Cryptanalysis Contest

#52

Post by TelegramApp »

The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (see contest FAQ: http://core.telegram.org/contestfaq).

Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to check its security and provide feedback. So if you are waiting for tools to try, e.g., a MITM on Telegram and get your $200К, please stay tuned. It's @telegram on Twitter." (https://news.ycombinator.com/item?id=6938987)

As for general critique of the protocol, please allow us to add a few vital corrections regarding the article (unfortunately, the author chose a platform that would not permit a direct comment).

> They use the broken SHA1 hash function.

SHA-1 isn't exactly broken. There is a theoretical paper from 2005 that describes a way to narrow down collision search from 2^80 to approx. 2^69 operations (http://people.csail.mit.edu/yiqun/SHA1AttackProceedingVersio...) with subsquent improvement to 2^63, but collisions won't help in the case at hand. In order to break the implementation in MTProto you would require generating a text with chosen SHA-1 (to our knowledge, this problem was not yet solved) — and even that wouldn't get one far, because of the server salt, session id and time.

More on our SHA-1 implementation here: http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the...

and here: http://core.telegram.org/techfaq#q-why-do-you-use-sha-1-in-t...

> they are trying to do “Mac and Encrypt” which is not secure.

We are not doing this. We are doing this: http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the...

> They rely on an obscure cipher mode called “Infinite Garble Extension.”

Yes, we do. The setup goes like this: http://core.telegram.org/techfaq#q-do-you-use-ige-ige-is-bro...

> Some really weird stuff about factoring 64-bit integers as part of the protocol.

This weird stuff can be pretty effective as part of our DoS-protection scheme.

Meanwhile, we've expanded our Tech FAQ with responses to most common questions concerning MTProto's robustness against certain types of active attacks:

http://core.telegram.org/techfaq#protection-against-known-at...

Thank you for your comments,

Telegram Team

Re: Telegram’s Cryptanalysis Contest

#53

Post by wil421 »

venomsnake wrote: post #20

Is there a reason why all fad "secure" products lately default to custom protocols and exotic solutions instead of using well tested and trusted solutions? Designing a protocol so that is does not leak is very hard.

> Designing a protocol so that is does not leak is very hard.

In some of the security classes in school some of my teachers said it was better to use an open and trusted protocol than reinvent the wheel.

They cautioned against using a closed source or proprietary protocol because there was not way to "vet" the code. I trust industry vetted solutions over "hip" new solutions that arent open. I am not sure if Telegram is open or not.

Re: Telegram’s Cryptanalysis Contest

#54

Post by chris_wot »

vitalyny wrote: post #50
xerophtye wrote: post #3

With all the publicity TextSecure is getting from all this Telegram Debacle, I am beginning to suspect telegram isn't even a real company, and just a very elaborate publicity stunt by Moxie and the rest of the TextSecure team!! :P

By the comments it seems that most of the active haters of Telegram are TextSecure team. Yes, they want publicity and funding - and who doesn't?

"Haters" is a very emotive term. There is no real hate I can detect form the TextSecure team. They have just pointed out flaws and why they feel that the solution is flawed.

You wouldn't be associated with Telegram, by any chance?

Re: Telegram’s Cryptanalysis Contest

#55

Post by Drakim »

raverbashing wrote: post #44
Drakim wrote: post #33

Earlier quoted context omitted.

> In a real attack you may, depending on the circumstances, only have access to that (at first, at least). You misunderstand the whole deal. When imagining different potential attacks on your house you can't go laying down rules that the burglars have to follow. What if there are special circumstances (that you weren't aware of) that allows the burglars to bypass your restrictions under certain conditions? You plan f…

"When imagining different potential attacks on your house you can't go laying down rules that the burglars have to follow" Of course. But everything is limited and for each scenario there's a specific chance that will happen. Some RSA key sizes are breakable if you can put a lot of computing power behind. For example, a house may not be built to withstand tanks, so there's your limitation. On the other hand, there's…

> Of course. But everything is limited and for each scenario there's a specific chance that will happen. Some RSA key sizes are breakable if you can put a lot of computing power behind.

I can agree with you that bruteforce attacks should not be within the scope of such a bug bounty prize or competition (unless somebody has exposed a flaw that allows for very easy brute forcing).

But that's not what's happening here. What's happening here is that the people running the show are handing out a few pieces of encrypted information and saying that since nobody can crack their stuff using that handed out information, their system is secure. It's easy to be confident in a controlled sterilized environment.

The blogger is pointing out that an attacker could very well have access to a lot more information and functionality than what they are handing out. They are only demonstrating that their system is safe in a "good case scenario" when everything goes as planned. They have not demonstrated that their system is secure if everything doesn't go as planned, if suddenly the attacker found a way to spoof the email messages and send his own prodding cypher, or something to that flavor, which isn't part of the neat little package they have arranged as part of competition.

Saying that "that's most likely not the case, the hackers wouldn't have anymore information or access" just is not a rebuttal to that. It's not a rebuttal to anything, it's just a brain fart.

Re: Telegram’s Cryptanalysis Contest

#56

Post by seertaak »

tptacek wrote: post #49
sillysaurus2 wrote: post #2

I wish there was an article that succinctly conveys to potential users why Telegram is snakeoil and why TextSecure is the real deal.

That would be nice. But, for what it's worth: don't use Telegram. It's a mess. TextSecure was built much, much more carefully.

Is TextSecure only for SMS messages, or does it use the internet? I'm asking because of the need to send text messages abroad (at a reasonable price). Also, is there a desktop client for TextSecure? I would love something like WhatsApp -- but secure and with a desktop client.

Re: Telegram’s Cryptanalysis Contest

#57

Post by shootaray »

yalogin wrote: post #43
infocollector wrote: post #39

I think people should keep quiet if they cant break their system. What good is a cryptographer, if its only good for pointing fingers?

Did you read the blog post? This is precisely what the OP is saying, that the contest is flawed. They are basically saying if you can break my new fancy lock you win but you can only see the lock over the webcam and not touch it.

If you can't get to the lock using the webcam, then stop writing blogs. Get to work. Don't complain that the lock internally uses sha-1, and ... Break it and then talk. Don't just point fingers. And anyone who mentions TextSecure in their blog, sounds like they have an ulterior motive writing the blog.

Re: Telegram’s Cryptanalysis Contest

#58

Post by vitalyny »

chris_wot wrote: post #54
vitalyny wrote: post #50

Earlier quoted context omitted.

By the comments it seems that most of the active haters of Telegram are TextSecure team. Yes, they want publicity and funding - and who doesn't?

"Haters" is a very emotive term. There is no real hate I can detect form the TextSecure team. They have just pointed out flaws and why they feel that the solution is flawed. You wouldn't be associated with Telegram, by any chance?

Alright, haters is probaby a too strong term. TextSecure team pointed out flaws in the first topic about Telegram on HN and these flaws were answered by Telegram team: they updated FAQ, they commented in twitter and here on HN. Every post with Telegram's flaws explicitly mentions TextSecure as an alternative, and that is suspicious - they seem to find it a great way to get publicity.

Re: Telegram’s Cryptanalysis Contest

#60

Post by jaxb »

vitalyny wrote: post #58
chris_wot wrote: post #54

Earlier quoted context omitted.

"Haters" is a very emotive term. There is no real hate I can detect form the TextSecure team. They have just pointed out flaws and why they feel that the solution is flawed. You wouldn't be associated with Telegram, by any chance?

Alright, haters is probaby a too strong term. TextSecure team pointed out flaws in the first topic about Telegram on HN and these flaws were answered by Telegram team: they updated FAQ, they commented in twitter and here on HN. Every post with Telegram's flaws explicitly mentions TextSecure as an alternative, and that is suspicious - they seem to find it a great way to get publicity.

So are you associated with telegram, just to be clear?
Post reply on HN