[messaging] An Analysis of the ProtonMail Cryptographic Architecture

[Mikalai Birukou]

1) On web delivery of code for e2e encryption.

Every time user opens site anew, server sends her new app. We may say 
that every single time there is an installation of an endpoint app. And 
if this an installation of a compromised version, we get ourselves into 
"Client State Compromise" situation. Yes, client is not *completely* 
compromised, but the most relevant section of it is.

Let's say that "No Client State Compromise" security assumption is 
incompatible with web delivery of code from an untrusted server?


2) On storing password-related things on server (oracles that allow 
offline brute-forcing of a password).

Is it be fair to say that we have a fundamental trade-off here. When 
system design allows user to restore her device with the help of 
password alone, server must store things that will ultimately include 
oracles that allow brute-forcing of the password.

Restore on a clean device is useful, for example when an attorney needs 
to pass a border, at which officer may inspect and copy all devices, 
demanding all related passwords. Attorney simply passes through border 
with a clean device, restoring it where officer has no legal right to 
demand password(s).

When system design has no password-related things stored server-side, 
user must carry important keys (encrypted with passwords, yada-yada). 
User must be vigilant. What advice should such user be given for 
border-crossing?


On 2018-11-20 3:45 a.m., Nadim Kobeissi wrote:
> Dear esteemed peers and colleagues,
>
> I have recently written an analysis of ProtonMail's cryptographic 
> architecture. ProtonMail is the world's largest encrypted email 
> provider with over five million users.
>
> Abstract:
> ProtonMail is an online email service that claims to offer end-to-end 
> encryption such that "even [ProtonMail] cannot read and decrypt [user] 
> emails." The service, based in Switzerland, offers email access via 
> webmail and smartphone applications to over five million users as of 
> November 2018. In this work, we provide the first independent analysis 
> of ProtonMail's cryptographic architecture. We find that for the 
> majority of ProtonMail users, no end-to-end encryption guarantees have 
> ever been provided by the ProtonMail service and that the 
> "Zero-Knowledge Password Proofs" are negated by the service itself. We 
> also find and document weaknesses in ProtonMail's "Encrypt-to-Outside" 
> feature. We justify our findings against well-defined security goals 
> and conclude with recommendations.
>
> Paper available on IACR ePrint:
> https://eprint.iacr.org/2018/1121
>
> I welcome your readership and your feedback.
>
> Kind regards,
>
> Nadim
> Sent from my computer
>
> _______________________________________________
> Messaging mailing list
> Messaging at moderncrypto.org
> https://moderncrypto.org/mailman/listinfo/messaging
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/messaging/attachments/20181125/1bc75c68/attachment.html>