Signal Blog

Our Twofish cryptanalysis contest offers a $10K prize for the best negative comments on Twofish that aren't written by the authors. There are no arbitrary definitions of what a winning analysis is. There is no ciphertext to break or keys to recover. We are simply rewarding the most successful cryptanalysis research result, whatever it may be and however successful it is (or is not). Again, the contest is fair because 1) the algorithm is completely specified, 2) there are no arbitrary definition of what winning means, and 3) the algorithm is public domain.

This Telegram contest may seem superficially similar to that fair contest, but it differs in some important ways. First, this contest isn't rewarding "best effort". Second, this contest doesn't meet those criteria, because their central server isn't being tested here. The goal of a product like Telegram is to defend against adversaries like governments, and hence governments will be able to probe their servers for weaknesses. You may say that we, too, can do the same, but if that's the case, a test server should be made available and the contest should explicitly try to get as many people as possible to break it.

This contest is interesting, but it's too artificial. As just one example of why that's the case: breaking real-world crypto often relies on side channel attacks, for instance timing attacks, and there's no opportunity of employing those attacks here due to the artificial nature of the contest.

Once again,…

One really good thing about having lots of apps though is that it makes it harder for the NSA to subvert the apps or developers and develop attacks. If there are so many of them from around the world springing up all the time, that makes it a lot more difficult for any one national agency to control the space and become omniscient, and more difficult for them to develop attacks which will work globally.

If there is one thing I'd take from this NSA/GCHQ debacle it's that encryption is the only way to stop numerous agencies from accessing the content of your communications and storing them indefinitely. They already want to store everything. If you encrypt they'll have to decrypt first before parsing and your messages, and that's impractical for them on a large scale. I'd love to see a replacement for email that used local encryption to send information completely encrypted (including metadata) from point to point, with no keys on the server, or perhaps no server at all.

Encryption is a way to keep things secret for some time, not forever, it won't keep things safe forever even if it is considered perfect at point of use, as usually flaws are found in protocols eventually, and new ones adopted for that reason. Even if there is an established attack on a given chat program, agencies would have to take the time to attack and decrypt communications specifically, rather than just intercepting them at providers or with line taps. It would prevent a great deal of casual snooping…

https://whispersystems.org/ TextSecure / RedPhone and/or https://silentcircle.com/ are a good place to start -- but AFAIK might not provide all the protection you need in a case like this.

Assumptions:

* the government has (or can easily) link you/your associates to a SIM/Router/DSL/Phoneline

* link your ip to said sim/router

* the government probably already have you listed as an "enemy" (assuming you've ever said or done anything useful in terms of protest, aren't completely spineless or apathetic)

Historically (in Latin/South America), at least one group will have support from the US -- so assume all VPN traffic is logged for trying to match up things like twitter posts to in-country IPs.

The only reasonable action is to use TOR for onion routing, and encryption tunnelled through that. This will still show that you communicate covertly (covertly, being "not-open"). It will still show bursts of activity, and clustering of devices (Note that if you both have access to location meta-data, and have half a brain and a couple of informers/officers noting down where people are gathering, you can feed that back into lists of SIM/IMEIs to target...).

The best approach would probably be to generate a rate-limited stream of traffic over TOR, and allow that stream to be replaced by communication as needed. I don't know of any tool to do this for phones -- but layering TOR and jabber+OTR might be about as good as you're going to get for now?

Have you heard of or used signal?

https://whispersystems.org/

Same idea -- strong crypto that's usable for anyone. It uses the OTR Ratchet protocol which uses perfect forward secrecy. The app also provides a way to verify keys through an OOB channel.

I would recommend considering OTR Ratchet integration just like WhatsApp did recently.

PGP is not a good design choice for a messaging app as you're always using asymmetric crypto operations which are computationally intense -- not terrible on modern computers but will be dreadful on mobile devices. Also can you provide some more documentation on how the app leverages PGP? Hopefully conversation is not using the same private keys to encrypt. That is vulnerable to data or side channel leakage. The modern approach is to generate and exchange an ephemeral key. Also please provide information on key storage.

Rather than making vague security claims like "first-rate" and " Security++ to the greatest extreme" you should rather provide a threat model and explain why one can remain confidential and have authenticity against particular types of adversaries. No security tool is perfect and it's only a matter of time before an adversary breaks it. Developers are doing a disservice by claiming anything more.

Before you can claim a first-rate security tool you will need to face a lot of scrutiny first.

Congratulations to the team! The native desktop apps have been top notch in user experience, speed and stability. Among messaging apps, Telegram has been my favorite for some years. Its development speed and feature introductions, at least in my knowledge, are unparalleled.

I've always liked the multi-device sync feature in Telegram and can't imagine using an app without that. My main concerns have been the home grown crypto and that normal chats are not end-to-end encrypted (only secret chats are). So I've been trying Wire [1] for a while, which provides both multi-device sync, multi-OS apps and end-to-end encrypted chats by default (there is no non-E2E chat). But it needs some more time to become much better (it's comparatively quite slow to startup and sync messages). Unfortunately, for all the fame that Signal [2] has on crypto and end-to-end encryption, it's the slowest in feature development among these apps.

[1]: https://wire.com

[2]: https://whispersystems.org

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth.

I don't really know what the solution is, but I'm very uneasy about the central point of failure Open Whisper Systems is. Moxie's previous points about the difficulty of upgrading a federated protocol[2] are correct, but I think that despite the difficulty it's important to do.

[1] http://freehaven.net/anonbib/cache/sassaman:wpes2005.pdf

[2] https://whispersystems.org/blog/the-ecosystem-is-moving/