Breakthrough in Very Large Integer factorization?

[jpcu1237]

Saw this in the news today:

https://www.silicon.co.uk/mobility/m...arrests-346164

and BBC article states, "Nikki Holland, NCA director of investigations, said the operational team had described it "as akin to cracking the enigma code".

https://www.bbc.com/news/uk-53263310

It appears that the platform used RSA and AES and other algorithms, but details unclear from open sources online.

So, if they did crack the algorithm, then a revolutionary breakthrough has occurred? Any chatter out there?

[retina]

The service protocol was hacked by police with a MITM device. Nothing new to see here. When discussing your criminal activities with people don't use insecure services that don't have E2E encryption, right?

The algorithms were not compromised.

Unless it is ruse to pretend they can't crack AES but secretly can. I find that unlikely.

[jpcu1237]

My sense is that you are correct. From what I read online about the platform, however, it was robust and E2E. The MITM device intercepted the encrypted comms, and then what? Maybe they captured keys somehow on HSM on devices?

[retina]

Originally Posted by jpcu1237

My sense is that you are correct. From what I read online about the platform, however, it was robust and E2E. The MITM device intercepted the encrypted comms, and then what? Maybe they captured keys somehow on HSM on devices?

No. It clearly wasn't robust. If it was then it wouldn't matter how many MITM devices were in the connection.

My guess is the client simply trusted the destination. So for A talking to B, the MITM will provide a key to A and say "Hi, I'm B", and A trusted it without verifying it was talking to the correct destination.

[jpcu1237]

Originally Posted by retina

No. It clearly wasn't robust. If it was then it wouldn't matter how many MITM devices were in the connection.

My guess is the client simply trusted the destination. So for A talking to B, the MITM will provide a key to A and say "Hi, I'm B", and A trusted it without verifying it was talking to the correct destination.

Agreed, not robust in the sense secure, since it failed. I meant based on the limited info left online:

EncroChat protects conversations with the following four tenets

Perfect Forward Secrecy Each message session with each contact is encrypted with a different set of keys. If any given key is ever compromised, it will never result in the compromise of previously transmitted messages – or even passive observation of future messages.

Repudiable Authentication Messages do not employ digital signatures that provide third party proofs. However, you are still assured you are messaging with whom you think you are.

Deniability Anyone can forge messages after a conversation is complete to make them look like they came from you. However, during a conversation the recipient is assured all messages received are authentic and unmodified. This assures non-reputability of messages.

Encryption Strength The algorithms employed are many times stronger than that of PGP (RSA+AES). We employ algorithms from different families of mathematics, which protects message content in the event that one encryption algorithm is ever solved.

http://encrochat.network
Maybe the authorities will publish a report on the architecture and what they did, but doubtful, unless researchers get interested.

[retina]

Originally Posted by jpcu1237

http://encrochat.network
Maybe the authorities will publish a report on the architecture and what they did, but doubtful, unless researchers get interested.

Self published "about" pages can make as many wonderful claims as they wish. But unless the code and protocols have been properly scrutinised and the implementation independently verified then such claims are meaningless.

[xilman]

Originally Posted by jpcu1237

So, if they did crack the algorithm, then a revolutionary breakthrough has occurred? Any chatter out there?

Exceedinlgly unlikely IMO.

Far more likely is exploitation of implementation weakness coupled with traffic analysis and infiltration of the user base. Classical espionage, in other words.

IMO, anyway.

[xilman]

Originally Posted by xilman

Exceedinlgly unlikely IMO.

Far more likely is exploitation of implementation weakness coupled with traffic analysis and infiltration of the user base. Classical espionage, in other words.

IMO, anyway.

My guess wasn't too far wrong.

https://www.vice.com/en_us/article/3...crochat-hacked has much more detail.

[retina]

Originally Posted by xilman

https://www.vice.com/en_us/article/3...crochat-hacked has much more detail.

So the MITM device was installed on the phone. Even easier for the police, just grab the plaintext.

So the question remains how was the malware installed? A compromised server delivering an-important-security-update? Which would just prove the point once you have a working system don't blindly "fix" it with updates.

[xilman]

Originally Posted by retina

So the MITM device was installed on the phone. Even easier for the police, just grab the plaintext.

Technically this is not a MITM, which requires a device between the end points, not at an end point.

Originally Posted by retina

So the question remains how was the malware installed? A compromised server delivering an-important-security-update? Which would just prove the point once you have a working system don't blindly "fix" it with updates.

That has not yet been established but it seems rather likely to me.

It is, of course, possible that there was an important security flaw which needed fixing.

[R.D. Silverman]

Originally Posted by xilman

Technically this is not a MITM, which requires a device between the end points, not at an end point.
That has not yet been established but it seems rather likely to me.

It is, of course, possible that there was an important security flaw which needed fixing.

Perhaps I should hire myself out.......

I could probably make big bucks.