Blog post by crypto professor Matthew Green, discussing what Telegram does (I wasn’t familiar with it) and criticizing its cryptography. He says Telegram by default is not end-to-end encrypted. It does have an end-to-end “secret chat” feature, but it’s a nuisance to activate and only works for two-person chats (not groups) where both people are online when the chat starts.
It still isn’t clear to me why Telegram’s founder was arrested. Green expresses some concern over that but doesn’t give any details that weren’t in the headlines.
I mean really, we don’t need an entire article to explain how encryption works on Telegram.
-
Chats by default aren’t fully e2e. Your key must be kept on the server(s) to enable instant sync with other devices
-
There is a full e2e chat, you can enable this at any time. But, it doesn’t do groups, it’s only between 2 parties, and it doesn’t sync across devices.
-
Telegram’s encryption isn’t open source, so no one can verify it’s soundness or risks.
None of this is new info, it’s been talked about for 2 years now.
We really don’t need more than #3 for a reason to stay far away from Telegram. Security through obscurity is not security, and neither is rolling your own crypto.
Telegram’s encryption isn’t open source, so no one can verify it’s soundness or risks.
This is not true, it is available in the open-source Telegram clients.
What you probably mean is that it is using an unusual and not well studied encryption algorithm. This means you need to be a real cryptography expert to spot flaws in it.
Telegram justifies this with a bit of FUD about well known encryption algorithm being NSA sponsored etc, but when cryptography experts did look at Telegram’s homegrown algorithm they were less than impressed.
As I recall, Telegram put up bounties for people actually demonstrating exploits in its encryption. Have any of these cryptography experts actually shown exploits?
telegram put up bounties relating to specific properties of their encryption, yes but there’s more to private messaging than just encryption… for example afaik it’s trivial to do things like replay attacks
their encryption may not be flawed, but they failed to design an algorithm that protects against the wide array of modern attacks, as they are mathematicians; not security experts. they understood the maths, but not the wider scope of implementation
a good example of these is linked down thread about MLS
Security properties of MLS include message confidentiality, message integrity and authentication, membership authentication, asynchronicity, forward secrecy, post-compromise security, and scalability.
the telegram bounties afaik only cover 1 security property
Are there any programs that can do e2e in a group chat? My limited knowledge of e2e and encryption makes me think that’d be extremely difficult and even clunkier
Group chat is a tricky problem and the modern crypto group (moderncrypto.org) talked about it at great length a few years back. I don’t know whether any software exists that incorporates all those ideas, but that’s mostly because I haven’t really been looking for it.
There is the MLS standard now that was explicitly developed with e2ee group chat applications in mind. From what I have read so far, this new standard seems well regarded by cryptography experts.
PGP/GPG encryption. It works with any IM, social network, anything (at least if the platform/program/app/medium allows for sufficiently lengthy messages so to carry the encrypted payload). There are some IMs that bring PGP/GPG natively, as well as extensions for existing IMs that also adds PGP/GPG feature, but PGP/GPG doesn’t need to be native to the app to convey encrypted messages, it’s a base64 text. It’s really an E2EE.
Messages app by Apple. Not extremely difficult, but has its trade offs, and easier when all devices share a CA.
This is pretty good, a discussion of possible motivation of the founder’s arrest, and comparison with an earlier scuffle involving the RIM Blackberry.
https://www.oblomovka.com/wp/2024/08/25/pavel-durov-and-the-blackberry-ratchet/
They can shut off that server whenever they want and then it won’t matter how encrypted your unsent message is.
Telegram is service as a software substitute.
