Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$300k for Cracking Telegram Encryption

telegram.org

Post reply on HN
Print view View original

81–90 of 94 posts

Re: $300k for Cracking Telegram Encryption

#81

Post by huhtenberg »

owenmarshall wrote: post #78
huhtenberg wrote: post #71

Earlier quoted context omitted.

It's fairly obvious that Telegram enjoys the challenge of designing their own crypto. The chances of them outsourcing the design are zero, because it will simply kill all the fun. That's not too dissimilar to suggesting hiring an ISO-certified shop to redo your beautiful hand-optimized assembly code in an industry-standard Java. It's a simplification, but I'm pretty sure a large chunk of HN can relate to how much of…

> It's fairly obvious that Telegram enjoys the challenge of designing their own crypto. The chances of them outsourcing the design are zero, because it will simply kill all the fun. Great! I like to scribble out sponge functions while eating lunch. I've made a few toy stream ciphers. Crypto is fun as all hell, and it's a great way to learn things! But novelty isn't really a good thing when it comes to actually depend…

> Because the applied crypto community points out issue after issue after issue with their product and is met with variations of "nuh uh, it's fine!"

Well, no. That's the thing. That's a Hollywood version of it. He said she said it's all horrible piece of shit, because of something someone else said earlier on an unrelated subject. What makes rounds is the regurgitated abstract hate towards Telegram, whereby the factual matter has been long forgotten.

Let me put it this way - name a couple of open design issues with the current Telegram protocol.

Re: $300k for Cracking Telegram Encryption

#83

Post by bhhaskin »

dwild wrote: post #30
bhhaskin wrote: post #4

Earlier quoted context omitted.

What....

In order to get the amount, you need to send an email to the secret email of the message, containing your bank account details. Nigerian prince scam also say that.

I get that, but i can't believe anyone that can crack encryption would send their banking information over email.

Re: $300k for Cracking Telegram Encryption

#84

Post by scott_karana »

For the cryptographic newb, can someone explain how this contest is rigged, and destined for failure, like the previous one apparently was?

The rules seem much more liberal this time, to my uneducated eyes...

Even if it's still a contest in bad faith, why not break it and claim the money?

Re: $300k for Cracking Telegram Encryption

#85

Post by praptak »

huhtenberg wrote: post #81
owenmarshall wrote: post #78

Earlier quoted context omitted.

> It's fairly obvious that Telegram enjoys the challenge of designing their own crypto. The chances of them outsourcing the design are zero, because it will simply kill all the fun. Great! I like to scribble out sponge functions while eating lunch. I've made a few toy stream ciphers. Crypto is fun as all hell, and it's a great way to learn things! But novelty isn't really a good thing when it comes to actually depend…

> Because the applied crypto community points out issue after issue after issue with their product and is met with variations of "nuh uh, it's fine!" Well, no. That's the thing. That's a Hollywood version of it. He said she said it's all horrible piece of shit, because of something someone else said earlier on an unrelated subject. What makes rounds is the regurgitated abstract hate towards Telegram, whereby the fact…

"Let me put it this way - name a couple of open design issues with the current Telegram protocol."

Sorry, it doesn't work this way: 'When someone hands you a security system and says, "I believe this is secure," the first thing you have to ask is, "Who the hell are you?" Show me what you've broken to demonstrate that your assertion of the system's security means something.'

Re: $300k for Cracking Telegram Encryption

#86

Post by huhtenberg »

praptak wrote: post #85
huhtenberg wrote: post #81

Earlier quoted context omitted.

> Because the applied crypto community points out issue after issue after issue with their product and is met with variations of "nuh uh, it's fine!" Well, no. That's the thing. That's a Hollywood version of it. He said she said it's all horrible piece of shit, because of something someone else said earlier on an unrelated subject. What makes rounds is the regurgitated abstract hate towards Telegram, whereby the fact…

"Let me put it this way - name a couple of open design issues with the current Telegram protocol." Sorry, it doesn't work this way: 'When someone hands you a security system and says, "I believe this is secure," the first thing you have to ask is, "Who the hell are you?" Show me what you've broken to demonstrate that your assertion of the system's security means something.'

Erm ... what "doesn't work this way"?

The GP said there were numerous issues identified with Telegram's design, all of which were brushed aside by Telegram devs. I asked to name a couple of them.

Re: $300k for Cracking Telegram Encryption

#87

Post by rthomas6 »

akerl_ wrote: post #80
rthomas6 wrote: post #77

The comments here are showing me that this contest is a good idea, because everyone is talking about Telegram. It doesn't matter that they're mostly saying they don't trust it. Without the contest, most people wouldn't even have heard of this app in the first place.

It's worth noting that the contest caused people here to talk about how Telegram's model of security and their approach to testing that security have flaws. But as is shown by the fact that they are running this contest, plenty of people who are not here see the contest and believe it is an indication of the trust they should have in Telegram. Otherwise, they wouldn't have run another contest after the response on HN…

I should have said "good idea for Telegram". I can see why the contest, and Telegram's general approach, is a bad idea for everyone as a whole, but IMO this is the best advertising $300,000 can buy.

Re: $300k for Cracking Telegram Encryption

#88

Post by owenmarshall »

huhtenberg wrote: post #81
owenmarshall wrote: post #78

Earlier quoted context omitted.

> It's fairly obvious that Telegram enjoys the challenge of designing their own crypto. The chances of them outsourcing the design are zero, because it will simply kill all the fun. Great! I like to scribble out sponge functions while eating lunch. I've made a few toy stream ciphers. Crypto is fun as all hell, and it's a great way to learn things! But novelty isn't really a good thing when it comes to actually depend…

> Because the applied crypto community points out issue after issue after issue with their product and is met with variations of "nuh uh, it's fine!" Well, no. That's the thing. That's a Hollywood version of it. He said she said it's all horrible piece of shit, because of something someone else said earlier on an unrelated subject. What makes rounds is the regurgitated abstract hate towards Telegram, whereby the fact…

> Let me put it this way - name a couple of open design issues with the current Telegram protocol.

https://core.telegram.org/img/mtproto_encryption1.png

The use of encrypt and MAC is the one that should jump out at even a crypto neophyte.

There are some nice proofs around this[1] that I've read before. The important one is that encrypt then MAC guarantees INT-CTXT: it's computationally infeasible to produce a ciphertext not before sent by the sender. INT-CTXT implies INT-PTXT which is the weaker claim but typically the one people associate with the function of a MAC: that you can't forge a plaintext the sender never sent.

While E&M isn't immediately bad it has been used as an avenue for attack[2]. If Telegram's aes_ige_decrypt() function accidentally overflows a buffer... and because they're doing E&M it must call aes_ige_decrypt() on whatever message I decide to send it.

Now, Telegram can claim that those attacks don't apply because of their use of IGE, and they may very well be correct! But then we move into IGE: there are known attacks that show chosen error introductions can cause the stream to resynchronize without error[3]. What does that mean in practice? Who knows: we know IGE is broken, but we don't know how badly because no one actually studies IGE, or knows how it is implemented in this system!

The real failings here: Telegram uses a MAC with less security guarantees AND a cipher mode that would be charitably described as anonymous, instead of using a provably secure MAC along with well-studied modes.

Now, I'm a big security dummy (seriously) but if there's one thing people far smarter than me have banged in my head, it's this: you follow the well-beaten path precisely because it is well-beaten. When you start venturing off the trail into the woods of funky block cipher modes and known-problematic MAC modes, your margins get a lot thinner.

[1]: http://cseweb.ucsd.edu/~mihir/papers/oem.pdf

[2]: http://www.thoughtcrime.org/blog/the-cryptographic-doom-prin...

[3]: https://groups.google.com/forum/#!topic/sci.crypt/4bkzm_n7UG...

Re: $300k for Cracking Telegram Encryption

#89

Post by tptacek »

owenmarshall wrote: post #88
huhtenberg wrote: post #81

Earlier quoted context omitted.

> Because the applied crypto community points out issue after issue after issue with their product and is met with variations of "nuh uh, it's fine!" Well, no. That's the thing. That's a Hollywood version of it. He said she said it's all horrible piece of shit, because of something someone else said earlier on an unrelated subject. What makes rounds is the regurgitated abstract hate towards Telegram, whereby the fact…

> Let me put it this way - name a couple of open design issues with the current Telegram protocol. https://core.telegram.org/img/mtproto_encryption1.png The use of encrypt and MAC is the one that should jump out at even a crypto neophyte. There are some nice proofs around this[1] that I've read before. The important one is that encrypt then MAC guarantees INT-CTXT: it's computationally infeasible to produce a ciphert…

What actual MAC is that?

Re: $300k for Cracking Telegram Encryption

#90

Post by dobbsbob »

rmsaksida wrote: post #58
tptacek wrote: post #9

Earlier quoted context omitted.

Both OTR (ChatSecure on your phone) and TextSecure are good options. Telegram is not a good option.

Unfortunately, those are not real alternatives to Telegram. Telegram is meant to be a WhatsApp replacement. WhatsApp thrives because in many places, SMS costs are prohibitive (so TextSecure is not an option). In addition, it requires no registration and doesn't rely on external services (so ChatSecure is also out of the question).

Textsecure for Android uses wifi/reg data and SMS if you want. Signal, the version for iOS with combined Redphone + TextSecure will be data too. Soon they will also allow email identity instead of only phone numbers. WhatsApp requires just as much registration as TS, and you have to allow WhatsApp full permissions to mine your entire device from reading SMS to /sdcard.
Post reply on HN