Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Received Diffie-Hellman group should be checked for prime size #22

Open
prosecco opened this issue Nov 8, 2015 · 0 comments
Open

Received Diffie-Hellman group should be checked for prime size #22

prosecco opened this issue Nov 8, 2015 · 0 comments

Comments

@prosecco
Copy link

prosecco commented Nov 8, 2015

The code for verifying the received Diffie-Hellman parameters from the server seems to not check the size of the prime, even though it correctly performs primality checks for this value (See https://github.com/Aseman-Land/libqtelegram-aseman-edition/blob/master/util/cryptoutils.cpp#L174).
This violates the MTProto spec that asks that the prime be 2048 bits long with leading bit set to 1 (see "Validation of DH parameters" https://core.telegram.org/mtproto/security_guidelines)

Due to this omission, this code will accept an arbitrary small prime, resulting in the confidentiality of secret chats being fully compromised. That is, if the Telegram server is broken into, the secret chats between CuteGram clients could be degraded to be equivalent to plaintext, even if the two clients know each other, check SHA-1 hashes of the msg_key etc. Admittedly, a compromise on the Telegram server may not be likely, but it is well within the threat model of the protocol.

Am I wrong? Is this check being done somewhere else?
If not, it should be trivial to add the check in CryptoUtils::checkDHParams using BN_num_bits

Best,
Karthik

@prosecco prosecco changed the title Received Diffie-Hellman group should be checked for size Received Diffie-Hellman group should be checked for prime size Nov 8, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant