If they have built some home-grown algorithm, then it's possible the NCA actually cracked the encryption (with a bit of help from GCHQ) rather than using the baseband processor to snoop on the keys or something like that.
A few years ago they rounded up a ring of crime phones in the Netherlands.. They were using PGP encryption, however instead of each phone generating its own private key, they generated them centrally and kept them in a database. Obviously this introduced a huge vulnerability.
The police compromised the server and was listening in (through cooperation with Canadian police as they were using Blackberries) for quite a while before they started kicking doors down :D They basically got all the evidence on a silver platter.
I'm surprised someone with the skill to develop such an app and service platform doesn't have the skill for avoiding such common mistakes. Or maybe they weren't able to explain to their users that the fact that they couldn't retrieve their messages after forgetting their pincode is a feature, not a bug. Either way, the police was really happy.
https://nationalpost.com/news/canada/canadian-judge-releases...
Not saying the same would have happened here, but crypto is hard to implement correctly and the algorithms are only part of the problem. And this kind of network is a massive target for law enforcement because the ratio of criminal users is huge.
My impression is that the way things go is:
* Sure, a smart person can implement a "homebrew" security protocol that seems safe.
* But smarter people never implement a "homebrew" security protocol and instead use existing protocols, 'cause they know how easy it is to fuck-up.
* The smartest people implement real, secure protocols, working in academic or three letter agencies and have those protocols vetted and peer reviewed. And even these fail on a regular basis.
- Crypto isn't that hard! I can do this!
- Crypto is a lot harder than I though. I shouldn't do this.
- I've read about a lot of crypto! I can do this!
- People way more experienced than me are making the tiniest mistakes that end up crashing the entire house of cards. I definitely shouldn't do this.
Designing a protocol correctly is not that hard, as long as you understand exactly what you are doing. By which I mean you are at least able to write an informal (yet rigorous) proof that it has the security properties you seek. Also, verification tools like Verifpal are a godsend. The tricky part here is avoiding the Dunning-Kruger effect. It's easy to have the illusion of perfect understanding while being unable to write the most basic mathematical proof.
The hardest part is convincing others that your protocol is any good. People who don't understand what you are doing cannot (perhaps even must not) trust your work. They need the vetting of someone reputable, and getting those reputable people to take a look is pretty hard if you don't have the right connections (an uphill struggle without a relevant PhD).
https://www.chch.com/niagara-drug-kingpin-goes-trial-murder/
Good for them, but I hope for their sake their names do not leak.
https://www.vice.com/en_us/article/3aza95/how-police-took-ov...
They probably just didn't use end-to-end because it's easier to offer a nice customer experience without.
Ideally, nobody should use any form of closed-source crypto any more.
"I didn't send those messages your honour. Someone forged them. I am a victim of a conspiracy!"
"Do you have any evidence that this actually happened?"
"No."
"...moving right along..."
It will be fun if someone from this actually tries a cryptogeek argument in real life...
In the case of a crypto forgeablity argument there will never be any proof. It will always be a false claim. It is a silly idea.
Yes they have, but they have been doing so in the face of circumstantial evidence: DNA, fingerprints, blood, whatever. Or eyewitness evidence: someone saw you go in the building at such and such time (perhaps there is a surveillence video).
If someone has nothing of the sort on you and their entire claim is that you wrote some digital message, I'd think the onus would be on them to prove their extraordinary claim somehow.
* https://articles.59.ca/doku.php?id=pgpfan:off_the_record
* https://articles.59.ca/doku.php?id=pgpfan:repudiability
So I am not disagreeing with what you said, it supports my contention that forgability is a silly cryptographic feature if there is no proof in the first place.
its the same issue with all modern e2e apps like whatsapp or signal, if there is a single client implementation its not secure at all to these kind of attacks.
There are (where?) actually multiple "distributions" of signal, like textSecure on f-droid. Last I checked it worked with signal, but that was a few years ago.
Is this not a bad thing? Since transferring key-pairs is the weakest link on these apps. To be really secure, wouldn't you want to do this as infrequently as possible and ideally outside in person outside the app?
You can still be more secure, but that's a decent start.
You can rotate message/session keys easily enough if you have a shared long(er) term key.
Did they roll their own?
Anyone doing secure comms at this level, and is talking about families of mathematics always gives me the impression they don't really know what they're doing.
Why is that? Do you assume that making competent choices for encryption algorithms (for which you try to understand the math problems involved) and trying to market the systems security means that they also try to implement it themselves? Or is the "family of mathematics" a sign for incompetence that I just don't recognize?
"Families of Mathematics" is a marketing statement, or "hot air" as I prefer to call it. The information content of that statement is zero, what it's doing is trying to project warm "you can trust us" feelings.
A statement aimed at technical people would read more like "we use AES-256-OFB with Axolotl on Curve25519 and scrypt(2^14, 8, 1)" or something like that.
To a crypto professional, I'd say any "trust us" statement that's not backed up by technical information actually lowers their trust in the system - it makes you wonder why they're not making their algorithm choice public.
I haven't looked into the service at all so could be totally off.
IMHO if your solution isn't open source, or least completely documented so it can be verified, then the whole point is moot anyway.
A savvy customer wants to know which algos you're using, and how you're using them, where you're using them. EC? RSA? Other? Which implementation are you using, is it audited? Standard based? Working with government, is it FIPS or similar? What does your KEx and KDF look like? Data at rest security? WHAT are you storing, and sending? Transport security? Metadata? Development practices?
There are a LOT of things a customer wants to know, and which or how many "family(/ies) of mathematics" has never been one of them, in my experience.
The number of branches of mathematics that you involve in the product doesn't mean anything.
Encrypting a message twice with different keys using exactly the same algorithm (thus the same branch of mathematics) is prima facie as effective a security increase as using some different algorithms involving different mathematics.
Most everyday crypto products rely on the results from several different areas of cryptography with different mathematics.
"It was not me, your Honour, as anyone can send a message by my (old) name)
https://en.wikipedia.org/wiki/Deniable_authentication
TLS provides a weaker version (instead of everyone in the world being able to forge a message, just your peer is able to forge the message).
No, they're assuring reputability, not non-reputability.
it's hard to tell though, the statements are a bit of a mess in general.
What I do find is various places using non-reputability erroneously as a synonym for non-repudiation.[1][2][3] So in fact I now think that EncroChat actually made 2 errors: said non-reputability instead of non-repudiation, and also misunderstood non-repudiation as meaning repudiation.
[1] https://books.google.com/books?id=qk_hDwAAQBAJ&pg=PT682&lpg=...
[2] https://books.google.com/books?id=_d7RUNF-2tcC&pg=PR21&lpg=P...
[3] https://books.google.com/books?id=PHBTDwAAQBAJ&pg=PA61&lpg=P...
> The algorithms employed are many times stronger than that of PGP (RSA+AES).
If they just used PGP over email, they wouldn't have gotten caught.
From what I have heard most criminals since the 90s use PGP over email (middle management and higher criminals not street thugs who probably just use WhatsApp or worse). They should go back to that.
So it doesn't matter what software they would have used since the device itself was capturing data before encryption and after decryption.
Law enforcement could replace an app, with their own, even for one specific user, if they have access to the system, granted by Google or Apple. I presume the signing can can be compromised, this way, but am unfamiliar to know this for sure.
And those companies would absolutely comply with a legal request to push intercept updates to phones.
* Each message session with each contact is encrypted with a different set of keys. If any given key is ever compromised, it will never result in the compromise of previously transmitted messages – or even passive observation of future messages.
* Anyone can forge messages after a conversation is complete to make them look like they came from you. However, during a conversation the recipient is assured all messages received are authentic and unmodified. This assures non-reputability of messages.
* The algorithms employed are many times stronger than that of PGP (RSA+AES). We employ algorithms from different families of mathematics, which protects message content in the event that one encryption algorithm is ever solved.
* Messages do not employ digital signatures that provide third party proofs. However, you are still assured you are messaging with whom you think you are.
source: https://encrochat.us/