How secure is TextSecure?

https://eprint.iacr.org/2014/904

by zorked • 12 years ago

137 28 12 years ago

eprint.iacr.org

tptacek2• 12 years ago

There are three concerns raised in this paper.

The first (A) is that TextSecure truncates SHA-2 hashes and, particularly, HMAC-SHA2 MACs. MAC truncation is extraordinarily common and is a design goal for most authenticated encryption schemes. So far as anyone knows, truncation of SHA-2 hashes and HMAC-SHA2 MACs is completely safe; that is, HMAC-SHA2 isn't somehow less safe when truncated than GCM or Poly1305.

The second (B) is that the authors believed TextSecure to have swapped some of the parameters for the HMAC algorithm. Moxie has asserted that this is a mistake by the paper authors, and that TextSecure uses HMAC conventionally.

The third (C, and most of the rest of the paper) is an identity misbinding attack. An identity misbinding attack happens when it becomes possible for Mallory to present Alice's public key to Bob instead of her own, and have Bob reply with a message encrypted to Mallory-seeming-Alice. Mallory can't decrypt the message, but because it's encrypted to a key Alice has, Alice might act based on the message contents. Identity misbinding problems are endemic to public-key cryptography. They are a real issue for protocols in which computers chat with each other and take action (like, authorizing an HTTP request) based on identities. They are less of an issue in chat protocols. Of particular importance, contextually: every other chat protocol has much, much worse key management problems.

Brian Smith says that this paper has value as part of a formal conversation about the security properties of TextSecure. I'm not qualified to evaluate that statement. I don't see anyone saying the paper has practical import for TextSecure or its users. TextSecure remains the best thing out there, I think.

BlueMatt2• 12 years ago

(B) Used to be correct (there were some constants used in the HMAC constants which are supposed to be 1/2, but were actually 0/1, of course this makes no difference practically to security), but this has been changed in more recent versions.

BlueMatt2• 12 years ago

Ehh, seems they were talking about different HMAC parameters and I was thinking about the HKDF...sorry (see the moderncrypto discussion for more).

higherpurpose3• 12 years ago

Could they be use BLAKE2 instead, which seems to have a "simpler design" than HMAC-SHA1/2:

https://blake2.net/

I believe miniLock uses it, too.

tptacek2• 12 years ago

What exactly would that improve in the security of TextSecure?

trevp• 12 years ago

Neither (A) nor (B) are concerns. In (B), the authors are just unfamiliar with HKDF. HKDF is a standard way to use HMAC for key derivation (RFC 5869).

(C) is the observation that you could lie and claim someone else's fingerprint (print it on your business card, for example). This doesn't accomplish much, but is a general issue with fingerprints (e.g. OTR, SSH).

You can try to bind more of the context (e.g. hash more identifying information into the session key or MAC), but this makes things rigid, particularly if parties might be contacted under aliases (e.g., imagine if SSH servers needed to be configured with all possible DNS names they might be contacted under, and rejected others).

But even then, you can't 100% prevent this - if the protocol "binds" the phone number, you can lie and claim someone else's phone number, or name, etc.

JoshTriplett• 12 years ago

The second (B) is that the authors believed TextSecure to have swapped some of the parameters for the HMAC algorithm. Moxie has asserted that this is a mistake by the paper authors, and that TextSecure uses HMAC conventionally.

You don't need to rely on the assertions of the authors; you can find the source at https://github.com/whispersystems/textsecure .

Spearchucker• 12 years ago

(C) costs little more than an extra round-trip - a verifying call from Alice to Bob, before she acts. After receiving the message from Mallory who is impersonating Bob, Alice simply sends Bob a nonce encrypted under Bob's public key. Bob performs a simple operation on the nonce, re-encrypts it with Alice's public key and sends it back to her, thereby verifying that he holds his private key.

Or am I missing something?

diafygi• 12 years ago

Thread in Modern Crypto: https://moderncrypto.org/mail-archive/messaging/2014/001029....

justcommenting2• 12 years ago

This sort of analysis underscores how different TextSecure is from the growing number of snake-oil/backdoored messaging applications out there.

Kudos to moxie and team for building usable free software; it's so much harder to build something that people can use than it is to criticize others' work.

mayneack• 12 years ago

I've got my parents using text secure - apart from a periodic MMS bug, they basically can't tell the difference. It's really good.

fbboisclair• 12 years ago

I can also confirm the simplicity, my wife use it all the time. It is simple to use.

darklajid2• 12 years ago

I'm still not invested into any IM solution. Running an xmpp server for my family (parents, wife, me - everyone else cannot use that because they're on Hangout or FB or Whatsapp etc..).

TextSecure certainly seems the best option, but its adoption wouldn't help me a lot (I could migrate my wife, my parents - but I most certainly won't be able to use it beyond that circle) and - I really, really dislike central services for communication. This isn't even a serious trust issue, I do believe that the developers of TextSecure are genuinely offering a great and secure text chat experience (ignoring that other solutions promise the same - Threema et al for example, but TextSecure comes with a lot more credibility and therefor trust). But I like to stay in control of my infrastructure. The xmpp server is the best fit - but the protocol and clients cause some issues and No One™ is using it, so the federation is a moot point.

justcommenting2• 12 years ago

Totally understand and respect your position. But one of the other great things about TextSecure is that although it may require a bit of work and you may not be interested, you could even run your own TextSecure server if you were so inclined because it's free software: https://github.com/WhisperSystems/TextSecure-Server

dharma1• 12 years ago

on a related note, anyone use RedPhone?

What if TextSecure and RedPhone were installed by default on a mobile operating system?

_asummers• 12 years ago

TextSecure is installed by default on CyanogenMod.

iamshs• 12 years ago

It varies. Note 2 CM installations are devoid of TextSecure. While Nexus installations do install TextSecure by default.

higherpurpose3• 12 years ago

Either that, or Google (or Microsoft or Apple) could use the same protocols as well for end-to-end encryption of voice and chats. And yes, hell could freeze over, too.

maaku• 12 years ago

Hell will freeze over, eventually. Expanding universe ftw.

exo762• 12 years ago

RedPhone lately fixed it's issues with quality of sound and latency. It's usable.

AlyssaRowan• 12 years ago

Wait until the whole thing gets renamed Signal, and then we'll see. :)

How secure is TextSecure?

Related Stories