Re:Why Isn’t Telegram End-to-End Encrypted by Default (2017)
by faitswulff on Monday January 11, 2021 @04:05PM
(#25736951)
I don't have a security or crypto background, but I saw an interesting bug story about Telegram, provocatively entitled "Cryptography Dispatches: The Most Backdoor-Looking Bug I’ve Ever Seen."
"Now, normally the two sides would compute the shared key as (g^a)^b mod p and (g^b)^a mod p. Instead, the original version of MTProto computed it as
(g^a)^b mod p XOR nonce
where nonce was an arbitrary, supposedly random value sent by the server along with the peer’s public contribution.
This was a completely non-standard and useless addition, and all it did was let the server perform an undetected Person-in-the-Middle attack."
"Now, normally the two sides would compute the shared key as (g^a)^b mod p and (g^b)^a mod p. Instead, the original version of MTProto computed it as
(g^a)^b mod p XOR nonce
where nonce was an arbitrary, supposedly random value sent by the server along with the peer’s public contribution.
This was a completely non-standard and useless addition, and all it did was let the server perform an undetected Person-in-the-Middle attack."
https://buttondown.email/cryptography-dispatches/archive/cry...