Smugness aside, I am actually concerned about this implementation and Telegram's response:
> The rest looks like matters of taste as opposed to objective reasoning. Can you name an actual attack?
The response to that is, "I shouldn't have to!" Anything that replaces a proven secure component with something that we haven't (yet) found an attack on is grounds for suspicion at the very least.
SHA-1 isn't a MAC. It's not that hard to make it so (HMAC), but Telegram hasn't.
> Again, we do not use MAC-then-encrypt. Our scheme is closer to MAC-and-encrypt with some essential modifications.
Out of the three options: MAC then encrypt, encrypt then MAC, and MAC and encrypt, only encrypt then MAC is secure (http://cseweb.ucsd.edu/~mihir/papers/oem.pdf) I don't care if they've made "essential modifications", they're replacing a component that is provably secure, with one that may or may not be secure.
> The rest looks like matters of taste as opposed to objective reasoning. Can you name an actual attack?
The response to that is, "I shouldn't have to!" Anything that replaces a proven secure component with something that we haven't (yet) found an attack on is grounds for suspicion at the very least.
SHA-1 isn't a MAC. It's not that hard to make it so (HMAC), but Telegram hasn't.
> Again, we do not use MAC-then-encrypt. Our scheme is closer to MAC-and-encrypt with some essential modifications.
Out of the three options: MAC then encrypt, encrypt then MAC, and MAC and encrypt, only encrypt then MAC is secure (http://cseweb.ucsd.edu/~mihir/papers/oem.pdf) I don't care if they've made "essential modifications", they're replacing a component that is provably secure, with one that may or may not be secure.