Missing Salamanders: Matrix Media can be decrypted to multiple valid plaintexts
A security vulnerability in the Matrix protocol allows attackers to decrypt media files due to lack of authenticated encryption, improper key association, and ambiguous specifications, compromising encrypted media security.
Read original article
The article discusses a significant security vulnerability in the Matrix protocol's handling of encrypted media in end-to-end chats. It highlights that Matrix does not implement authenticated encryption for media files, allowing attackers to potentially decrypt ciphertext using multiple keys. This flaw arises because the ciphertext is stored without proper association to its encryption parameters, leading to a situation where any key and IV can be used to decrypt the same ciphertext, resulting in numerous valid plaintexts. The author outlines the timeline of discovering and reporting the issue, culminating in a public disclosure. The article also critiques the Matrix specification for its ambiguous language regarding encryption requirements, which could lead to insecure implementations. Furthermore, it references a novel attack on AES-GCM that allows for the construction of ciphertexts that can decrypt to multiple plaintexts, emphasizing the need for stronger cryptographic practices. The author provides a proof of concept demonstrating how different file formats can be combined and encrypted, showcasing the practical implications of the vulnerability. The findings suggest that without proper authentication and verification mechanisms, the security of encrypted media in Matrix is compromised.
- Matrix protocol lacks authenticated encryption for media files, leading to security vulnerabilities.
- Attackers can decrypt ciphertext using multiple keys due to improper association with encryption parameters.
- The specification's ambiguous language may result in insecure implementations by clients.
- A novel attack on AES-GCM illustrates the potential for multiple valid plaintexts from a single ciphertext.
- The article includes a proof of concept demonstrating the practical implications of the vulnerability.
Related
Not So Secret: Analysis of KakaoTalk's Chat E2EE Feature
KakaoTalk's Secret Chat feature has significant vulnerabilities, including susceptibility to man-in-the-middle attacks and lack of essential security measures. Users are advised to consider more secure alternatives like Signal.
What Does It Mean to Be a Signal Competitor?
The article outlines criteria for messaging apps to compete with Signal, emphasizing open source, end-to-end encryption, and secure implementation. It warns against prioritizing features over user privacy and security.
Against XMPP+omemo
XMPP's integration of OMEMO for encryption has been criticized for inadequate security standards, outdated implementations, and complexity, leaving it less secure than alternatives like Signal for private messaging.
Hacking a Virtual Power Plant
Ryan Castellucci identified vulnerabilities in GivEnergy's API related to a 512-bit RSA key, allowing unauthorized access. GivEnergy promptly upgraded to a 4096-bit key, emphasizing the need for secure cryptographic practices.
Security Issues in Matrix's Olm Library
The Matrix's Olm library has critical cryptographic vulnerabilities, including cache-timing attacks and malleable signatures. The security team will not address these issues, advising users to switch to the vodozemac library.
1 commentsRelated
Not So Secret: Analysis of KakaoTalk's Chat E2EE Feature
KakaoTalk's Secret Chat feature has significant vulnerabilities, including susceptibility to man-in-the-middle attacks and lack of essential security measures. Users are advised to consider more secure alternatives like Signal.
What Does It Mean to Be a Signal Competitor?
The article outlines criteria for messaging apps to compete with Signal, emphasizing open source, end-to-end encryption, and secure implementation. It warns against prioritizing features over user privacy and security.
Against XMPP+omemo
XMPP's integration of OMEMO for encryption has been criticized for inadequate security standards, outdated implementations, and complexity, leaving it less secure than alternatives like Signal for private messaging.
Hacking a Virtual Power Plant
Ryan Castellucci identified vulnerabilities in GivEnergy's API related to a 512-bit RSA key, allowing unauthorized access. GivEnergy promptly upgraded to a 4096-bit key, emphasizing the need for secure cryptographic practices.
Security Issues in Matrix's Olm Library
The Matrix's Olm library has critical cryptographic vulnerabilities, including cache-timing attacks and malleable signatures. The security team will not address these issues, advising users to switch to the vodozemac library.