Subverting Telegram’s End-to-End Encryption
Telegram is a popular secure messaging service with third biggest user base as of 2021. In this paper, we analyze the security of Telegram’s end-to-end encryption (E2EE) protocol in presence of mass-surveillance. Specifically, we show >that Telegram’s E2EE protocol is susceptible to fairly effic...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2023-03-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/10302 |
| _version_ | 1811154502721470464 |
|---|---|
| author | Benoît Cogliati Jordan Ethan Ashwin Jha |
| author_facet | Benoît Cogliati Jordan Ethan Ashwin Jha |
| author_sort | Benoît Cogliati |
| collection | DOAJ |
| description |
Telegram is a popular secure messaging service with third biggest user base as of 2021. In this paper, we analyze the security of Telegram’s end-to-end encryption (E2EE) protocol in presence of mass-surveillance. Specifically, we show >that Telegram’s E2EE protocol is susceptible to fairly efficient algorithm substitution attacks. While official Telegram clients should be protected against this type of attack due their open-source nature and reproducible builds, this could potentially lead to a very efficient state sponsored surveillance of private communications over Telegram, either on individuals through a targeted attack or massively through some compromised third-party clients. We provide an efficient algorithm substitution attack against MTProto2.0 — the underlying authenticated encryption scheme — that recovers significant amount of encryption key material with a very high probability with few queries and fairly low latency. This could potentially lead to a very efficient state sponsored surveillance of private communications over Telegram, either through a targeted attack or a compromised third-party app. Our attack exploits MTProto2.0’s degree of freedom in choosing the random padding length and padding value. Accordingly, we strongly recommend that Telegram should revise MTProto2.0’s padding methodology. In particular, we show that a minor change in the padding description of MTProto2.0 makes it subversion-resistant in most of the practical scenarios. As a side-effect, we generalize the underlying mode of operation in MTProto2.0, as MTProto-G, and show that this generalization is a multi-user secure deterministic authenticated encryption scheme.
|
| first_indexed | 2024-04-10T04:17:50Z |
| format | Article |
| id | doaj.art-0c117e472bfe4a4abdd4a05182484b87 |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-04-10T04:17:50Z |
| publishDate | 2023-03-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-0c117e472bfe4a4abdd4a05182484b872023-03-11T15:37:40ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2023-03-012023110.46586/tosc.v2023.i1.5-40Subverting Telegram’s End-to-End EncryptionBenoît Cogliati0Jordan Ethan1Ashwin Jha2CISPA Helmholtz Center for Information Security, Saarbrücken, GermanyCISPA Helmholtz Center for Information Security, Saarbrücken, GermanyCISPA Helmholtz Center for Information Security, Saarbrücken, Germany Telegram is a popular secure messaging service with third biggest user base as of 2021. In this paper, we analyze the security of Telegram’s end-to-end encryption (E2EE) protocol in presence of mass-surveillance. Specifically, we show >that Telegram’s E2EE protocol is susceptible to fairly efficient algorithm substitution attacks. While official Telegram clients should be protected against this type of attack due their open-source nature and reproducible builds, this could potentially lead to a very efficient state sponsored surveillance of private communications over Telegram, either on individuals through a targeted attack or massively through some compromised third-party clients. We provide an efficient algorithm substitution attack against MTProto2.0 — the underlying authenticated encryption scheme — that recovers significant amount of encryption key material with a very high probability with few queries and fairly low latency. This could potentially lead to a very efficient state sponsored surveillance of private communications over Telegram, either through a targeted attack or a compromised third-party app. Our attack exploits MTProto2.0’s degree of freedom in choosing the random padding length and padding value. Accordingly, we strongly recommend that Telegram should revise MTProto2.0’s padding methodology. In particular, we show that a minor change in the padding description of MTProto2.0 makes it subversion-resistant in most of the practical scenarios. As a side-effect, we generalize the underlying mode of operation in MTProto2.0, as MTProto-G, and show that this generalization is a multi-user secure deterministic authenticated encryption scheme. https://tosc.iacr.org/index.php/ToSC/article/view/10302TelegramMTProtoalgorithm substitutionkey recovery |
| spellingShingle | Benoît Cogliati Jordan Ethan Ashwin Jha Subverting Telegram’s End-to-End Encryption IACR Transactions on Symmetric Cryptology Telegram MTProto algorithm substitution key recovery |
| title | Subverting Telegram’s End-to-End Encryption |
| title_full | Subverting Telegram’s End-to-End Encryption |
| title_fullStr | Subverting Telegram’s End-to-End Encryption |
| title_full_unstemmed | Subverting Telegram’s End-to-End Encryption |
| title_short | Subverting Telegram’s End-to-End Encryption |
| title_sort | subverting telegram s end to end encryption |
| topic | Telegram MTProto algorithm substitution key recovery |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/10302 |
| work_keys_str_mv | AT benoitcogliati subvertingtelegramsendtoendencryption AT jordanethan subvertingtelegramsendtoendencryption AT ashwinjha subvertingtelegramsendtoendencryption |