Automated Symbolic Verification of Telegram's MTProto 2.0

This page summarizes the projects mentioned and recommended in the original post on news.ycombinator.com

InfluxDB - Power Real-Time Data Analytics at Scale
Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
www.influxdata.com
featured
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com
featured
  • Telegram-iOS

    Telegram-iOS

  • Can you really compile them?

    If you look at the iOS repo, first there is no license associated with the repo. Second, there are lots of people reporting failed builds in the issue tracker without a response.

    https://github.com/TelegramMessenger/Telegram-iOS

  • zre_raft

    Peer-to-peer encrypted chat using ZRE and double ratchet.

  • Even if the clients are open source and if the verification of the protocol using ProVerif is sound, there is the possibility of a divergence between the "proof" and the implementation.

    This is why it's important to have them in the same code base.

    I've heard about attempts at inria to implement signal/double ratchet using F-star and verify the correctness. But no such implementation seems to be publicly available.

    One of the things I'm interested in is to see if it's possible to bring these verification technologies to more mainstream programming languages such as python.

    https://github.com/adsharma/zre_raft/blob/main/zre_raft/zre_...

    is something I'd love to verify.

  • InfluxDB

    Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

    InfluxDB logo
  • OpenSSL

    TLS/SSL and crypto library

  • > made up mode

    It's was implemented in OpenSSL 15 years ago.

    https://github.com/openssl/openssl/blob/master/crypto/aes/ae...

  • TextSecure

    A private messenger for Android.

  • Threema offers reproducible builds as well, for the Android app: https://threema.ch/en/open-source/reproducible-builds

    Signal too: https://github.com/signalapp/Signal-Android/blob/master/repr...

    Regarding the iOS app store, Telegram writes:

    > As things stand now, you'll need a jailbroken device, at least 1,5 hours and approximately 90GB of free space to properly set up a virtual machine for the verification process.

    https://core.telegram.org/reproducible-builds#reproducible-b...

    It's a manual process within a new VM. I wouldn't be surprised if it frequently breaks without anyone noticing. But at least they're trying, I'm not aware of any better approach. Apple's GUI-focussed approach doesn't make these things easy.

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts

  • Heartbleed and XZ Backdoor Learnings: Open Source Infrastructure Can Be Improved Efficiently With Moderate Funding

    2 projects | dev.to | 7 Apr 2024
  • Ask HN: How does the xz backdoor replace RSA_public_decrypt?

    1 project | news.ycombinator.com | 1 Apr 2024
  • Use of HTTPS Resource Records

    1 project | news.ycombinator.com | 4 Jan 2024
  • openssl-3.2.0 released

    1 project | /r/linux | 25 Nov 2023
  • Large performance degradation in OpenSSL 3

    1 project | news.ycombinator.com | 6 Oct 2023