undefined | Better HN

0 pointsowenmarshall11y ago0 comments

> It's fairly obvious that Telegram enjoys the challenge of designing their own crypto. The chances of them outsourcing the design are zero, because it will simply kill all the fun.

Great! I like to scribble out sponge functions while eating lunch. I've made a few toy stream ciphers. Crypto is fun as all hell, and it's a great way to learn things!

But novelty isn't really a good thing when it comes to actually depending on crypto. You want something that's been well studied by lots of smart people. To paraphrase Schneier (I believe), anyone can design an encryption process that they can't break - the real challenge is keeping the people who are smarter than you from breaking it as well.

Novelty is an _extremely_ bad reason to design and deploy cryptography.

> They want less surveillance. Now pray tell why they should have their head repeatedly dunk in a toilet bowl every time their project gets a mention?

Because the applied crypto community points out issue after issue after issue with their product and is met with variations of "nuh uh, it's fine!"

Bad crypto is worse than no crypto because either way the NSA is watching you, but when you use no crypto you're at least forced to admit to yourself that your adversary has you in their crosshairs.

0 comments

5 comments · 1 top-level

huhtenberg11y ago· 4 in thread

> Because the applied crypto community points out issue after issue after issue with their product and is met with variations of "nuh uh, it's fine!"

Well, no. That's the thing. That's a Hollywood version of it. He said she said it's all horrible piece of shit, because of something someone else said earlier on an unrelated subject. What makes rounds is the regurgitated abstract hate towards Telegram, whereby the factual matter has been long forgotten.

Let me put it this way - name a couple of open design issues with the current Telegram protocol.

owenmarshallOP11y ago

> Let me put it this way - name a couple of open design issues with the current Telegram protocol.

https://core.telegram.org/img/mtproto_encryption1.png

The use of encrypt and MAC is the one that should jump out at even a crypto neophyte.

There are some nice proofs around this[1] that I've read before. The important one is that encrypt then MAC guarantees INT-CTXT: it's computationally infeasible to produce a ciphertext not before sent by the sender. INT-CTXT implies INT-PTXT which is the weaker claim but typically the one people associate with the function of a MAC: that you can't forge a plaintext the sender never sent.

While E&M isn't immediately bad it has been used as an avenue for attack[2]. If Telegram's aes_ige_decrypt() function accidentally overflows a buffer... and because they're doing E&M it must call aes_ige_decrypt() on whatever message I decide to send it.

Now, Telegram can claim that those attacks don't apply because of their use of IGE, and they may very well be correct! But then we move into IGE: there are known attacks that show chosen error introductions can cause the stream to resynchronize without error[3]. What does that mean in practice? Who knows: we know IGE is broken, but we don't know how badly because no one actually studies IGE, or knows how it is implemented in this system!

The real failings here: Telegram uses a MAC with less security guarantees AND a cipher mode that would be charitably described as anonymous, instead of using a provably secure MAC along with well-studied modes.

Now, I'm a big security dummy (seriously) but if there's one thing people far smarter than me have banged in my head, it's this: you follow the well-beaten path precisely because it is well-beaten. When you start venturing off the trail into the woods of funky block cipher modes and known-problematic MAC modes, your margins get a lot thinner.

[1]: http://cseweb.ucsd.edu/~mihir/papers/oem.pdf

[2]: http://www.thoughtcrime.org/blog/the-cryptographic-doom-prin...

[3]: https://groups.google.com/forum/#!topic/sci.crypt/4bkzm_n7UG...

tptacek11y ago

What actual MAC is that?

1 more reply

praptak11y ago

"Let me put it this way - name a couple of open design issues with the current Telegram protocol."

Sorry, it doesn't work this way: 'When someone hands you a security system and says, "I believe this is secure," the first thing you have to ask is, "Who the hell are you?" Show me what you've broken to demonstrate that your assertion of the system's security means something.'

huhtenberg11y ago

Erm ... what "doesn't work this way"?

The GP said there were numerous issues identified with Telegram's design, all of which were brushed aside by Telegram devs. I asked to name a couple of them.

j / k navigate · click thread line to collapse