The contest, as proposed by Pavel, while limited for the moment, does cover an important issue as far as our users are concerned. And the scope will naturally expand with time, should Telegram be invulnerable under the current conditions (see contest FAQ:
http://core.telegram.org/contestfaq).
Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to check its security and provide feedback. So if you are waiting for tools to try, e.g., a MITM on Telegram and get your $200К, please stay tuned. It's @telegram on Twitter."
(https://news.ycombinator.com/item?id=6938987)
As for general critique of the protocol, please allow us to add a few vital corrections regarding the article (unfortunately, the author chose a platform that would not permit a direct comment).
> They use the broken SHA1 hash function.
SHA-1 isn't exactly broken. There is a theoretical paper from 2005 that describes a way to narrow down collision search from 2^80 to approx. 2^69 operations (http://people.csail.mit.edu/yiqun/SHA1AttackProceedingVersio...) with subsquent improvement to 2^63, but collisions won't help in the case at hand. In order to break the implementation in MTProto you would require generating a text with chosen SHA-1 (to our knowledge, this problem was not yet solved) — and even that wouldn't get one far, because of the server salt, session id and time.
More on our SHA-1 implementation here:
http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the...
and here:
http://core.telegram.org/techfaq#q-why-do-you-use-sha-1-in-t...
> they are trying to do “Mac and Encrypt” which is not secure.
We are not doing this. We are doing this:
http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the...
> They rely on an obscure cipher mode called “Infinite Garble Extension.”
Yes, we do. The setup goes like this:
http://core.telegram.org/techfaq#q-do-you-use-ige-ige-is-bro...
> Some really weird stuff about factoring 64-bit integers as part of the protocol.
This weird stuff can be pretty effective as part of our DoS-protection scheme.
Meanwhile, we've expanded our Tech FAQ with responses to most common questions concerning MTProto's robustness against certain types of active attacks:
http://core.telegram.org/techfaq#protection-against-known-at...
Thank you for your comments,
Telegram Team
Quoting a post by Pavel here on HN: "Telegram will always be interested in creating incentives for the crypto-community to check its security and provide feedback. So if you are waiting for tools to try, e.g., a MITM on Telegram and get your $200К, please stay tuned. It's @telegram on Twitter." (https://news.ycombinator.com/item?id=6938987)
As for general critique of the protocol, please allow us to add a few vital corrections regarding the article (unfortunately, the author chose a platform that would not permit a direct comment).
> They use the broken SHA1 hash function.
SHA-1 isn't exactly broken. There is a theoretical paper from 2005 that describes a way to narrow down collision search from 2^80 to approx. 2^69 operations (http://people.csail.mit.edu/yiqun/SHA1AttackProceedingVersio...) with subsquent improvement to 2^63, but collisions won't help in the case at hand. In order to break the implementation in MTProto you would require generating a text with chosen SHA-1 (to our knowledge, this problem was not yet solved) — and even that wouldn't get one far, because of the server salt, session id and time.
More on our SHA-1 implementation here: http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the...
and here: http://core.telegram.org/techfaq#q-why-do-you-use-sha-1-in-t...
> they are trying to do “Mac and Encrypt” which is not secure.
We are not doing this. We are doing this: http://core.telegram.org/techfaq#q-are-you-doing-encrypt-the...
> They rely on an obscure cipher mode called “Infinite Garble Extension.”
Yes, we do. The setup goes like this: http://core.telegram.org/techfaq#q-do-you-use-ige-ige-is-bro...
> Some really weird stuff about factoring 64-bit integers as part of the protocol.
This weird stuff can be pretty effective as part of our DoS-protection scheme.
Meanwhile, we've expanded our Tech FAQ with responses to most common questions concerning MTProto's robustness against certain types of active attacks:
http://core.telegram.org/techfaq#protection-against-known-at...
Thank you for your comments,
Telegram Team