Telegram recently updated its symmetric-key encryption scheme MTProto, which seems to fix some known vulnerabilities. Nevertheless, I still do not understand why they roll their own crypto. What properties/advantages do they gain from their homemade MTProto encryption scheme beyond those already provided by the standard key derivation and authenticated encryption schemes?

  • 4
    $\begingroup$ Why don't ask you Telegram directly? $\endgroup$ – mentallurg Jun 19 '18 at 23:04
  • 2
    $\begingroup$ @PaulUszak Yes, I think the current MTProto scheme is still using AES IGE, but it also has key derivation and message authentication components. So, I am referring to the whole MTProto encryption scheme vs authenticated encryption scheme. But we can assume the DH result has been properly shared between the end users. $\endgroup$ – Shan Chen Jun 20 '18 at 0:16
  • 2
    $\begingroup$ @mentallurg Thanks for reminding me of this option. I just sent an email to their security feedback, but I doubt getting any meaningful response. $\endgroup$ – Shan Chen Jun 20 '18 at 0:18
  • 3
    $\begingroup$ I don't know why, but probably a combination of naivete, ignorance and arrogance. Everything I've read says that its crypto is terrible. $\endgroup$ – Swashbuckler Jun 24 '18 at 13:19
  • 2
    $\begingroup$ The "why" is always hard to answer. They do seem to be using standard primitives (although you can argue that IGE modes are not that standard) and try and implement their own protocol. That's possibly not as bad as inventing your own primitives (algorithms) such as variants of RSA or AES but it leaves enough room for mistakes - as their implementation clearly seems to show, yes. $\endgroup$ – Maarten Bodewes Jan 27 '19 at 17:46

Browse other questions tagged or ask your own question.