2

Recently Telegram announced using CDN in some territories where they don't want to place main servers. Although the internals are not explained, according to provided diagram and information, a key is passed from Telegram server to Telegram user which CDN is not aware of. Telegram Encrypted CDNs Since the file/file segment is encrypted before being uploaded to CDN, I'm assuming encryption algorithm is of symmetric-key type. Now, even a new key is used for each file/file segment, that key is the same for everyone (Otherwise each file should has an encrypted version for each user which is not practical). No matter how the key is sent to Telegram user (i.e. end-to-end encrypted) at the client side that key could be extracted by every client, including the one in control of the officials. So,

What's the point of encrypting CDN contents and pass such a key directly to the Telegram user?

  • 1
    Short answer:yes – Peekbyte Jul 30 '17 at 16:02
  • If one of the user in the channel is controlled by your attacker, they don't need to attack the CDN to get a copy and decrypt the file. They can just request the file as an authorized member of that channel. – Lie Ryan Jul 31 '17 at 16:42
  • @LieRyan: You right. Wondering why they told media CDN data cannot be decrypted. When CDN knows about data, users could be tracked. – Xaqron Jul 31 '17 at 17:37
  • 1
    @Xaqron: I think you misunderstood my comment. If the attacker is already in the channel, they are going to be able to download and decrypt the file, CDN or no CDN. Distributing the encrypted file via the CDN doesn't add any more security risks that weren't already there. – Lie Ryan Jul 31 '17 at 19:40
  • @LieRyan: When officials know what are the encrypted files on CDN then then can trace who access them while without CDN (end to end encryption) that doesn't happen. This is a security risk. – Xaqron Jul 31 '17 at 19:50
4

First, AES-256-CTR (as labeled on one of the squares) is in fact a symmetric cipher. No assumption required.

A more important aspect of this scheme is really preventing the CDN from changing files in an undetected manner.

The link between the client and Telegram server is presumably trusted, and information to verify the legitimacy of files in the CDN is transferred (ie. key and hash). If the CDN changes files, the trusted hashes will no longer match the malicious files.

This CDN scheme is only used for publicly shared files on Telegram, so the file can be considered to be at least quasi-public. The CDN host might obtain the key using Telegram which would also allow them to re-encrypt the file, but there is still no way for them to make the hash of the modified file match.

  • Thanks. CDN cannot change the file as you said but what's the point of encrypting content when it can easily be decrypted by officials? (just check the hash). And does identity (IP address) of clients downloading those files compromised by downloading such content? – Xaqron Jul 30 '17 at 9:13
  • I think the point of the encryption is future planning. Right now the CDN only holds files that are public in Telegram making the AES seem pointless, but in the future the scheme could be used to enforce tighter permissions on files by only distributing the key to users that are allowed to view the file. In that scenario anyone that has the key could also just redistribute the file... sharing the key would be equivalent to sharing the original file which is always possible. – trognanders Jul 30 '17 at 20:04
  • Yes, this scheme very much does reveal the IP address of Telegram CDN users to the CDN host. They might use something like tor to prevent this. – trognanders Jul 30 '17 at 20:05
0

AES is indeed symmetric cipher.

Assuming decryption key (of AES-256) is only known by "Telegram Server" and "Telegram User" (answering your question of why server need to send key only to user) then CDN cannot decrypt the content (of course it can always bruteforce the key, but it is infeasible).

SHA-256 is a hash function, it is a one way function. Given hash function H(x) of a value x, the value y = H(x) can only be known (ideally) if you know what x is. I can give you, or publish, y but you will not be able to know x (except by bruteforcing it). But if you have x you can easily verify if its hash value equal to already published y

  • CDN doesn't need to brute-force, anyone can extract the keys from a client under control. Simply, encryption is broken although it was not necessary in the first place. – Xaqron Jul 30 '17 at 19:41
  • i haven't read telegram's protocol in details, but a client should have a different key with another client. So a CDN need to control all clients in order to decrypt all of their content – hesahesa Jul 30 '17 at 20:43
  • upon reading telegram's post, they said "The CDN can't access the data it stores because these keys are only accessible to the main MTProto server and to the authorized client." this authorized client apparently will be a group of public channel who have 100,000+ members. 100,000+ members will share a same key, so a CDN needs to only control one of them. But again, i agree with Bailey since CDN currently only holds anything public it is not too intrusive, they might need tighter scenario – hesahesa Jul 30 '17 at 20:53
  • Now we are on the same page. So what Durov stated as "CDNs can’t access the data" is wrong but as you said it is not a severe issue. Contents are public and there is no need for encryption. The only problem is CDN can track who downloads which file (CDN is aware of data since encryption is broken) and can identify users of a channel by IP and the content they download. – Xaqron Jul 30 '17 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.