[whispersystems] How does contact encryption work?

[a***@tuta.io]

What information about my contacts does the Signal server collect? Here's my
understanding of the process: I create an account with my number, which is
stored as a hash on the Signal server. A friend installs Signal, and the
Signal network scans his contact list, encrypting it first. His contacts'
numbers are hashed and checked against the server to find any matches. The
server sees my number hash in the server and in his contact list, so I'm
added to his Signal contacts. Therefore, at no point does the Signal server
store anything but phone # hashes.

Is this accurate? If not, would you please explain or direct me to an
explanation? I was discussing this with someone, and they warned me that if
numbers are being hashed in the server, they're easily crackable. He said
that modern GPUs can calculate up to 200 million hashes per second which
means they could  have a complete hashtable of all possible phone numbers in
seconds.

[Xavier Lebrun]

in my understanding.

signal mostly protect the content of the message and calls

it does not aims to provide strong anonymity.
metadata is not encrypted just they do not store logs at server side....

for anonymity you would need a tor compatible solution (xmpp+tor like :
chatsecure, conversations, freelab messenger xmpp, xabber)

or something p2p based on tox-core

as i said in the community thread
there is a need for a forum to discuss those points which are not
development specific

Post by a***@tuta.io
What information about my contacts does the Signal server collect? Here's
my understanding of the process: I create an account with my number, which
is stored as a hash on the Signal server. A friend installs Signal, and the
Signal network scans his contact list, encrypting it first. His contacts'
numbers are hashed and checked against the server to find any matches. The
server sees my number hash in the server and in his contact list, so I'm
added to his Signal contacts. Therefore, at no point does the Signal server
store anything but phone # hashes.
Is this accurate? If not, would you please explain or direct me to an
explanation? I was discussing this with someone, and they warned me that if
numbers are being hashed in the server, they're easily crackable. He said
that modern GPUs can calculate up to 200 million hashes per second which
means they could have a complete hashtable of all possible phone numbers
in seconds.

[Jani Monoses]

Post by a***@tuta.io
What information about my contacts does the Signal server collect? Here's
my understanding of the process: I create an account with my number, which
is stored as a hash on the Signal server. A friend installs Signal, and the
Signal network scans his contact list, encrypting it first. His contacts'
numbers are hashed and checked against the server to find any matches. The
server sees my number hash in the server and in his contact list, so I'm
added to his Signal contacts. Therefore, at no point does the Signal server
store anything but phone # hashes.
Is this accurate? If not, would you please explain or direct me to an
explanation? I was discussing this with someone, and they warned me that if
numbers are being hashed in the server, they're easily crackable. He said
that modern GPUs can calculate up to 200 million hashes per second which
means they could have a complete hashtable of all possible phone numbers
in seconds.

https://whispersystems.org/blog/contact-discovery/

[a***@tuta.io]

Jani,

Thanks for the link. It touches on the hashing issue. However, it doesn't
explain what Signal's process is for contact discovery. Is there an
explanation somewhere?

Post by Jani Monoses

Post by a***@tuta.io
What information about my contacts does the Signal server

collect? Here's my understanding of the process: I create an account with
my number, which is stored as a hash on the Signal server. A friend
installs Signal, and the Signal network scans his contact list, encrypting
it first. His contacts' numbers are hashed and checked against the server
to find any matches. The server sees my number hash in the server and in
his contact list, so I'm added to his Signal contacts. Therefore, at no
point does the Signal server store anything but phone # hashes.
Is this accurate? If not, would you please explain or direct me to an
explanation? I was discussing this with someone, and they warned me that
if numbers are being hashed in the server, they're easily crackable. He
said that modern GPUs can calculate up to 200 million hashes per second
which means they could  have a complete hashtable of all possible phone
numbers in seconds.

https://whispersystems.org/blog/contact-discovery/

[a***@tuta.io]

Also, in the Signal Wiki, it says: In order to determine which contacts are
also Signal users, cryptographic hashes of the user's contact numbers are
periodically transmitted to the server.[41]

Source [41] links to your link, Jani. However, that blog post does not say
that Signal uses hashes, only that hashing is a solution that doesn't work.
Is this an error in the Wiki?

source: https://en.wikipedia.org/wiki/Signal_%28software%29#Servers

--
Securely sent with Tutanota. Claim your encrypted mailbox today!
https://tutanota.com

Post by a***@tuta.io
Jani,
Thanks for the link. It touches on the hashing issue. However, it doesn't
explain what Signal's process is for contact discovery. Is there an
explanation somewhere?

Post by Jani Monoses

Post by a***@tuta.io
What information about my contacts does the Signal server

collect? Here's my understanding of the process: I create an account with
my number, which is stored as a hash on the Signal server. A friend
installs Signal, and the Signal network scans his contact list,
encrypting it first. His contacts' numbers are hashed and checked against
the server to find any matches. The server sees my number hash in the
server and in his contact list, so I'm added to his Signal contacts.
Therefore, at no point does the Signal server store anything but phone #
hashes.
Is this accurate? If not, would you please explain or direct me to an
explanation? I was discussing this with someone, and they warned me that
if numbers are being hashed in the server, they're easily crackable. He
said that modern GPUs can calculate up to 200 million hashes per second
which means they could  have a complete hashtable of all possible phone
numbers in seconds.

https://whispersystems.org/blog/contact-discovery/

[Jani Monoses]

"For TextSecure, however, we’ve grown beyond the size where that remains
practical, so the only thing we can do is write the server such that it
doesn’t store the transmitted contact information, inform the user, and
give them the choice of opting out."

This suggests that hashing is used. It is not secure, but the secure
protocols were (and probably still are) at the time of writing
prohibitively inefficient.

Check out this recent thread for more info:
https://moderncrypto.org/mail-archive/messaging/2015/001827.html

Post by a***@tuta.io
Also, in the Signal Wiki, it says: In order to determine which contacts
are also Signal users, cryptographic hashes
<https://en.wikipedia.org/wiki/Cryptographic_hash_function> of the user's
contact numbers are periodically transmitted to the server.[41]
Source [41] links to your link, Jani. However, that blog post does not say
that Signal uses hashes, only that hashing is a solution that doesn't work.
Is this an error in the Wiki?
source: https://en.wikipedia.org/wiki/Signal_%28software%29#Servers
--
Securely sent with Tutanota. Claim your encrypted mailbox today!
https://tutanota.com
Jani,
Thanks for the link. It touches on the hashing issue. However, it doesn't
explain what Signal's process is for contact discovery. Is there an
explanation somewhere?

Post by a***@tuta.io
What information about my contacts does the Signal server collect? Here's
my understanding of the process: I create an account with my number, which
is stored as a hash on the Signal server. A friend installs Signal, and the
Signal network scans his contact list, encrypting it first. His contacts'
numbers are hashed and checked against the server to find any matches. The
server sees my number hash in the server and in his contact list, so I'm
added to his Signal contacts. Therefore, at no point does the Signal server
store anything but phone # hashes.
Is this accurate? If not, would you please explain or direct me to an
explanation? I was discussing this with someone, and they warned me that if
numbers are being hashed in the server, they're easily crackable. He said
that modern GPUs can calculate up to 200 million hashes per second which
means they could have a complete hashtable of all possible phone numbers
in seconds.

https://whispersystems.org/blog/contact-discovery/

[Boskote]

anonday,

There was a similar thread on this list a couple months ago, and this
post from Brad was an informative overview of the situation surrounding
contact
discovery:https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html

I found the following sentence to be most relevant in terms of the
security issues posed by the contact discovery process: "If the server
is indeed successful in not storing, logging, leaking the protocol
messages used to (transiently) calculate contact intersection, and the
channel from phone to server isn't compromised, then the contact list
from a particular phone is not leaked directly - but the list
(obfuscated by the hash) does get sent over the wire so those 'ifs'
matter in tough environments."

In other words, if someone has access to either the signal server, or
the channel from the phone to the server, then they could in theory get
access to your contact list as a result of the contact discovery
process. This sounds bad, however it is worth keeping in mind that
someone with either of these accesses would probably also be able to see
every Signal message you send, which unavoidably reveals the subset of
your contact list that you communicate with through Signal over the
period of time that they have access. Assuming the adversary has long
term access, they would have all of your Signal contacts. In that case,
the contact discovery process would only be meaningfully revealing the
members of your contact list that are not using Signal. Assuming your
are communicating with these people using regular calls or text
messages, then this metadata would be much more widely revealed/recorded
by the telecommunications and intelligence institutions.

The conclusions I draw from this are that the contact discovery process
makes contact list info more vulnerable than it would be otherwise in
the two following situations:
1) When an adversary would only have temporary access to the signal
server or the channel between the phone and the server, and can
therefore intercept contact discovery info but not very many signal
communications.
2) When a phone's contact list contains members that are not being
communicated with using that phone (either through Signal or through
less secure means).

I find this analysis relevant for more clearly evaluating the privacy
side of the trade-off between privacy and the benefits of contact
discovery (as outlined at the beginning of the blog post
<https://whispersystems.org/blog/contact-discovery/>). adelante,

Boskote


On 21 January 2016 at 12:56, Jani Monoses <***@gmail.com
<mailto:***@gmail.com>> wrote:

"For TextSecure, however, we’ve grown beyond the size where that
remains practical, so the only thing we can do is write the server
such that it doesn’t store the transmitted contact information,
inform the user, and give them the choice of opting out."

This suggests that hashing is used. It is not secure, but the secure
protocols were (and probably still are) at the time of writing
prohibitively inefficient.

Check out this recent thread for more info:
https://moderncrypto.org/mail-archive/messaging/2015/001827.html
<https://moderncrypto.org/mail-archive/messaging/2015/001827.html>

On Thu, Jan 21, 2016 at 7:49 PM, <***@tuta.io
<mailto:***@tuta.io>> wrote:

Also, in the Signal Wiki, it says: In order to determine which
contacts are also Signal users, cryptographic hashes
<https://en.wikipedia.org/wiki/Cryptographic_hash_function> of
the user's contact numbers are periodically transmitted to the
server.^[41]

Source [41] links to your link, Jani. However, that blog post
does not say that Signal uses hashes, only that hashing is a
solution that doesn't work. Is this an error in the Wiki?

source:
https://en.wikipedia.org/wiki/Signal_%28software%29#Servers
<https://en.wikipedia.org/wiki/Signal_%28software%29#Servers>

--
Securely sent with Tutanota. Claim your encrypted mailbox today!
https://tutanota.com

21. Jan 2016 17:32 by ***@tuta.io <mailto:***@tuta.io>:

Jani,

Thanks for the link. It touches on the hashing issue.
However, it doesn't explain what Signal's process is for
contact discovery. Is there an explanation somewhere?

21. Jan 2016 17:02 by ***@gmail.com
<mailto:***@gmail.com>:



On Thu, Jan 21, 2016 at 6:56 PM, <***@tuta.io
<mailto:***@tuta.io>> wrote:

What information about my contacts does the Signal
server collect? Here's my understanding of the
process: I create an account with my number, which
is stored as a hash on the Signal server. A friend
installs Signal, and the Signal network scans his
contact list, encrypting it first. His contacts'
numbers are hashed and checked against the server to
find any matches. The server sees my number hash in
the server and in his contact list, so I'm added to
his Signal contacts. Therefore, at no point does the
Signal server store anything but phone # hashes.

Is this accurate? If not, would you please explain
or direct me to an explanation? I was discussing
this with someone, and they warned me that if
numbers are being hashed in the server, they're
easily crackable. He said that modern GPUs can
calculate up to 200 million hashes per second which
means they could have a complete hashtable of all
possible phone numbers in seconds.


https://whispersystems.org/blog/contact-discovery/
<https://whispersystems.org/blog/contact-discovery/>

[a***@tuta.io]

Boskote,

Thanks for the message. When you say,  "someone with either of these accesses
would probably also be able to see every Signal message you
send", do you mean the meta data, or the content, too?

Thanks,
anonday

Post by Boskote

Post by Boskote
anonday,

There was a similar thread on this list a couple months ago,

and this post from Brad was an informative overview of the situation
surrounding contact discovery:>
https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html
I found the following sentence to be most relevant in terms of the
security issues posed by the contact discovery process: "If the
server is indeed successful in not storing, logging, leaking the
protocol messages used to (transiently) calculate contact
intersection, and the channel from phone to server isn't compromised,
then the contact list from a particular phone is not leaked directly -
but the list (obfuscated by the hash) does get sent over the wire > so
those 'ifs' matter in tough environments."
In other words, if someone has access to either the signal
server, or the channel from the phone to the server, then they could
in theory get access to your contact list as a result of the contact
discovery process. This sounds bad, however it is worth keeping in
mind that someone with either of these accesses would probably also
be able to see every Signal message you send, which unavoidably
reveals the subset of your contact list that you communicate with
through Signal over the period of time that they have access.
Assuming the adversary has long term access, they would have all of
your Signal contacts. In that case, the contact discovery process
would only be meaningfully revealing the members of your contact
list that are not using Signal. Assuming your are communicating with
these people using regular calls or text messages, then this
metadata would be much more widely revealed/recorded by the
telecommunications and intelligence institutions.

Post by Boskote

Post by Boskote
The conclusions I draw from this are that the contact

discovery process makes contact list info more vulnerable than it

Post by Boskote

Post by Boskote
1) When an adversary would only have temporary access

to the signal server or the channel between the phone and the
server, and can therefore intercept contact discovery info but not
very many signal communications.

Post by Boskote

Post by Boskote
2) When a phone's contact list contains members that

are not being communicated with using that phone (either through
Signal or through less secure means).

Post by Boskote

Post by Boskote
I find this analysis relevant for more clearly

evaluating the privacy side of the trade-off between privacy and the
benefits of contact discovery (as outlined at the beginning of the >
blog post> ). adelante,

Post by Boskote

Post by Boskote
Boskote

On 21 January 2016 at 12:56, Jani Monoses <>

Post by Boskote

"For TextSecure, however, we’ve grown beyond the

size where that remains practical, so the only thing we can
do is write the server such that it doesn’t store the
transmitted contact information, inform the user, and give
them the choice of opting out."

Post by Boskote

This suggests that

hashing is used. It is not secure, but the secure
protocols were (and probably still are) at the time of
writing prohibitively inefficient.>>

Post by Boskote

Check out this recent

thread for more info:>> >> https://moderncrypto.org/mail>>
-archive/messaging/2015/001827.html

Post by Boskote

On Thu, Jan 21, 2016 at 7:49 PM, <>>

Also, in the Signal Wiki,

it says: In order to determine which contacts are
also Signal users, >>> cryptographic hashes>>> of the
user's contact numbers are periodically
transmitted to the server.>>> [41]
Source [41] links to your link, Jani. However,
that blog post does not say that Signal uses
hashes, only that hashing is a solution that
doesn't work. Is this an error in the Wiki?
source: >>> https://en.wikipedia.org/wiki/>>>
Signal_%28software%29#Servers
--
Securely sent with Tutanota. Claim your encrypted
mailbox today!

https://tutanota.com

Jani,
Thanks for the link. It touches on the hashing
issue. However, it doesn't explain what
Signal's process is for contact discovery. Is
there an explanation somewhere?
21. Jan 2016 17:02 by >>>>

Post by Boskote
On Thu, Jan

What information about my contacts
does the Signal server collect?
Here's my understanding of the
process: I create an account with
my number, which is stored as a
hash on the Signal server. A
friend installs Signal, and the
Signal network scans his contact
list, encrypting it first. His
contacts' numbers are hashed and
checked against the server to find
any matches. The server sees my
number hash in the server and in
his contact list, so I'm added to
his Signal contacts. Therefore, at
no point does the Signal server
store anything but phone # hashes.
Is this accurate? If not, would
you please explain or direct me to
an explanation? I was discussing
this with someone, and they warned
me that if numbers are being
hashed in the server, they're
easily crackable. He said that
modern GPUs can calculate up to
200 million hashes per second
which means they could  have a
complete hashtable of all possible
phone numbers in seconds.

https://whispersystems.org/>>>>> blog/contact-discovery/

[Boskote]

Oh, just the metadata. The content is end-to-end encrypted on your phone!
I'm sure OWS would encrypt the metadata in the same way if they could,
but then the server wouldn't know who to send the message to :)

Boskote


On 22 January 2016 at 00:40, <***@tuta.io <mailto:***@tuta.io>>
wrote:

Boskote,

Thanks for the message. When you say, "someone with either of these
accesses would probably also be able to see every Signal message you
send", do you mean the meta data, or the content, too?

Thanks,
anonday


22. Jan 2016 05:19 by ***@riseup.net <mailto:***@riseup.net>:


anonday,

There was a similar thread on this list a couple months ago, and
this post from Brad was an informative overview of the situation
surrounding contact
discovery:<https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html>https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html
<https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html>

I found the following sentence to be most relevant in terms of
the security issues posed by the contact discovery process: "If
the server is indeed successful in not storing, logging, leaking
the protocol messages used to (transiently) calculate contact
intersection, and the channel from phone to server isn't
compromised, then the contact list from a particular phone is
not leaked directly - but the list (obfuscated by the hash) does
get sent over the wire so those 'ifs' matter in tough environments."

In other words, if someone has access to either the signal
server, or the channel from the phone to the server, then they
could in theory get access to your contact list as a result of
the contact discovery process. This sounds bad, however it is
worth keeping in mind that someone with either of these accesses
would probably also be able to see every Signal message you
send, which unavoidably reveals the subset of your contact list
that you communicate with through Signal over the period of time
that they have access. Assuming the adversary has long term
access, they would have all of your Signal contacts. In that
case, the contact discovery process would only be meaningfully
revealing the members of your contact list that are not using
Signal. Assuming your are communicating with these people using
regular calls or text messages, then this metadata would be much
more widely revealed/recorded by the telecommunications and
intelligence institutions.

The conclusions I draw from this are that the contact discovery
process makes contact list info more vulnerable than it would be
otherwise in the two following situations:
1) When an adversary would only have temporary access to the
signal server or the channel between the phone and the server,
and can therefore intercept contact discovery info but not very
many signal communications.
2) When a phone's contact list contains members that are not
being communicated with using that phone (either through Signal
or through less secure means).

I find this analysis relevant for more clearly evaluating the
privacy side of the trade-off between privacy and the benefits
of contact discovery (as outlined at the beginning of the blog
post <https://whispersystems.org/blog/contact-discovery/>).
adelante,

Boskote


On 21 January 2016 at 12:56, Jani Monoses
<***@gmail.com <mailto:***@gmail.com>> wrote:

"For TextSecure, however, we’ve grown beyond the size where
that remains practical, so the only thing we can do is write
the server such that it doesn’t store the transmitted
contact information, inform the user, and give them the
choice of opting out."

This suggests that hashing is used. It is not secure, but
the secure protocols were (and probably still are) at the
time of writing prohibitively inefficient.

Check out this recent thread for more info:
https://moderncrypto.org/mail-archive/messaging/2015/001827.html

On Thu, Jan 21, 2016 at 7:49 PM, <***@tuta.io
<mailto:***@tuta.io>> wrote:

Also, in the Signal Wiki, it says: In order to determine
which contacts are also Signal users, cryptographic
hashes
<https://en.wikipedia.org/wiki/Cryptographic_hash_function>
of the user's contact numbers are periodically
transmitted to the server.^[41]

Source [41] links to your link, Jani. However, that blog
post does not say that Signal uses hashes, only that
hashing is a solution that doesn't work. Is this an
error in the Wiki?

source:
https://en.wikipedia.org/wiki/Signal_%28software%29#Servers

--
Securely sent with Tutanota. Claim your encrypted
mailbox today!
https://tutanota.com

21. Jan 2016 17:32 by ***@tuta.io
<mailto:***@tuta.io>:

Jani,

Thanks for the link. It touches on the hashing
issue. However, it doesn't explain what Signal's
process is for contact discovery. Is there an
explanation somewhere?

21. Jan 2016 17:02 by ***@gmail.com
<mailto:***@gmail.com>:



On Thu, Jan 21, 2016 at 6:56 PM,
<***@tuta.io <mailto:***@tuta.io>> wrote:

What information about my contacts does the
Signal server collect? Here's my
understanding of the process: I create an
account with my number, which is stored as a
hash on the Signal server. A friend installs
Signal, and the Signal network scans his
contact list, encrypting it first. His
contacts' numbers are hashed and checked
against the server to find any matches. The
server sees my number hash in the server and
in his contact list, so I'm added to his
Signal contacts. Therefore, at no point does
the Signal server store anything but phone #
hashes.

Is this accurate? If not, would you please
explain or direct me to an explanation? I
was discussing this with someone, and they
warned me that if numbers are being hashed
in the server, they're easily crackable. He
said that modern GPUs can calculate up to
200 million hashes per second which means
they could have a complete hashtable of all
possible phone numbers in seconds.


https://whispersystems.org/blog/contact-discovery/

[a***@tuta.io]

Oh, good. I figured you meant the meta-data, but wasn't sure.

Thanks,
anonday

Post by Boskote

Post by Boskote
Oh, just the metadata. The content is end-to-end

encrypted on your phone!

Post by Boskote
I'm sure OWS would encrypt the metadata in the same way if

they could, but then the server wouldn't know who to send the message
to :)

Post by Boskote

Post by Boskote
Boskote

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io
Boskote,

Thanks for the message. When you say,  ">> someone with
either of these accesses would probably also be able to see
every Signal message you send", do you mean the meta data, or
the content, too?
Thanks,
anonday

Post by Boskote

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote
anonday,

There was a similar thread on

this list a couple months ago, and this post from Brad
was an informative overview of the situation
surrounding contact discovery:>>>

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io
https://lists.riseup.net/www/>>>

arc/whispersystems/2015-12/msg00000.html
I found the following sentence to be most relevant
in terms of the security issues posed by the contact
discovery process: "If the server is indeed
successful in not storing, logging, leaking the
protocol messages used to (transiently) calculate
contact intersection, and the channel from phone to
server isn't compromised, then the contact list from a
particular phone is not leaked directly - but the list
(obfuscated by the hash) does get sent over the wire

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io
so those 'ifs' matter in tough environments."

In other words, if someone has access to either
the signal server, or the channel from the phone
to the server, then they could in theory get
access to your contact list as a result of the
contact discovery process. This sounds bad, however
it is worth keeping in mind that someone with either
of these accesses would probably also be able to see
every Signal message you send, which unavoidably
reveals the subset of your contact list that you
communicate with through Signal over the period of
time that they have access. Assuming the adversary
has long term access, they would have all of your
Signal contacts. In that case, the contact discovery
process would only be meaningfully revealing the
members of your contact list that are not using
Signal. Assuming your are communicating with these
people using regular calls or text messages, then
this metadata would be much more widely
revealed/recorded by the telecommunications and
intelligence institutions.

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote
The conclusions I draw from

this are that the contact discovery process makes
contact list info more vulnerable than it would be

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote
1) When an adversary would

only have temporary access to the signal server or
the channel between the phone and the server, and
can therefore intercept contact discovery info but
not very many signal communications.

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote
2) When a phone's contact

list contains members that are not being
communicated with using that phone (either through
Signal or through less secure means).

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote
I find this analysis

relevant for more clearly evaluating the privacy
side of the trade-off between privacy and the
benefits of contact discovery (as outlined at the
beginning of the >>> blog post>>> ). adelante,

Post by Jani Monoses

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote
Boskote

On 21 January 2016 at 12:56,

Post by Boskote

Post by Jani Monoses
"For TextSecure,

however, we’ve grown beyond the size where
that remains practical, so the only thing we
can do is write the server such that it
doesn’t store the transmitted contact
information, inform the user, and give them
the choice of opting out."

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote

Post by a***@tuta.io

This

suggests that hashing is used. It is not
secure, but the secure protocols were
(and probably still are) at the time of
writing prohibitively inefficient.>>>>

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote

Post by a***@tuta.io

Check

out this recent thread for more info:>>>>

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses
https://moderncrypto.org/mail>>>>

-archive/messaging/2015/001827.html

Post by a***@tuta.io

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses
On Thu, Jan 21,

Post by Boskote

Post by a***@tuta.io
Also, in the Signal Wiki, it

says: In order to determine which
contacts are also Signal users, >>>>>
cryptographic hashes>>>>> of the
user's contact numbers are
periodically transmitted to the
server.>>>>> [41]
Source [41] links to your link,
Jani. However, that blog post does
not say that Signal uses hashes,
only that hashing is a solution
that doesn't work. Is this an
error in the Wiki?
source: >>>>>
https://en.wikipedia.org/wiki/>>>>> Signal_%28software%29#Servers
--
Securely sent with Tutanota. Claim
your encrypted mailbox today!

Post by a***@tuta.io

Post by Boskote

Post by Jani Monoses

Post by Boskote

Post by a***@tuta.io
https://tutanota.com

21. Jan 2016 17:32 by >>>>>

Post by a***@tuta.io
Jani,
Thanks for the link. It touches
on the hashing issue. However, it
doesn't explain what Signal's
process is for contact discovery.
Is there an explanation somewhere?
21. Jan 2016 17:02 by >>>>>>

Post by Boskote

Post by Jani Monoses

Post by Boskote

Post by a***@tuta.io

On

Thu, Jan 21, 2016 at 6:56

Post by Jani Monoses

Post by Boskote

Post by a***@tuta.io

What

information about
my contacts does
the Signal server
collect? Here's my
understanding of the
process: I create an
account with my
number, which is
stored as a hash on
the Signal server. A
friend installs
Signal, and the Signal
network scans his
contact list,
encrypting it first.
His contacts' numbers
are hashed and checked
against the server to
find any matches. The
server sees my number
hash in the server and
in his contact list,
so I'm added to his
Signal contacts.
Therefore, at no point
does the Signal server
store anything but
phone # hashes.
Is this accurate?
If not, would you
please explain or
direct me to an
explanation? I was
discussing this
with someone, and they
warned me that if
numbers are being
hashed in the server,
they're easily
crackable. He said
that modern GPUs can
calculate up to 200
million hashes per
second which means
they could  have a
complete hashtable of
all possible phone
numbers in seconds.

Post by Boskote

Post by a***@tuta.io

https://whispersystems.org/>>>>>>>

blog/contact-discovery/

[Boskote]

The LEAP project (which is currently in early beta for email, but also
has plans to do chat) has a good overview of this metadata problem in
their design docs, which they also describe as the problem of "graph
resistant routing": https://leap.se/en/docs/tech/routing
They outline some possible solutions, though from what I can tell they
all seem pretty distant from the current design and infrastructure of
Signal.

What if it worked sorta like TOR, with the packets encrypted in many layers
and bounced around a few random people in the network before being
delivered, with only the original sender and the one receiving the message
in the end knowing both who sent it and who received it? Is that something
that could work, and provide better protection to private metadata (at
least while in transit)?

Post by Boskote
Oh, just the metadata. The content is end-to-end encrypted on your phone!
I'm sure OWS would encrypt the metadata in the same way if they could, but
then the server wouldn't know who to send the message to :)
Boskote

Post by a***@tuta.io
Boskote,
Thanks for the message. When you say, "someone with either of these
accesses would probably also be able to see every Signal message you send",
do you mean the meta data, or the content, too?
Thanks,
anonday
anonday,
There was a similar thread on this list a couple months ago, and this
post from Brad was an informative overview of the situation surrounding
<https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html>
<https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html>
https://lists.riseup.net/www/arc/whispersystems/2015-12/msg00000.html
I found the following sentence to be most relevant in terms of the
security issues posed by the contact discovery process: "If the server is
indeed successful in not storing, logging, leaking the protocol messages
used to (transiently) calculate contact intersection, and the channel from
phone to server isn't compromised, then the contact list from a particular
phone is not leaked directly - but the list (obfuscated by the hash) does
get sent over the wire so those 'ifs' matter in tough environments."
In other words, if someone has access to either the signal server, or the
channel from the phone to the server, then they could in theory get access
to your contact list as a result of the contact discovery process. This
sounds bad, however it is worth keeping in mind that someone with either of
these accesses would probably also be able to see every Signal message you
send, which unavoidably reveals the subset of your contact list that you
communicate with through Signal over the period of time that they have
access. Assuming the adversary has long term access, they would have all of
your Signal contacts. In that case, the contact discovery process would
only be meaningfully revealing the members of your contact list that are
not using Signal. Assuming your are communicating with these people using
regular calls or text messages, then this metadata would be much more
widely revealed/recorded by the telecommunications and intelligence
institutions.
The conclusions I draw from this are that the contact discovery process
makes contact list info more vulnerable than it would be otherwise in the
1) When an adversary would only have temporary access to the signal
server or the channel between the phone and the server, and can therefore
intercept contact discovery info but not very many signal communications.
2) When a phone's contact list contains members that are not being
communicated with using that phone (either through Signal or through less
secure means).
I find this analysis relevant for more clearly evaluating the privacy
side of the trade-off between privacy and the benefits of contact discovery
(as outlined at the beginning of the blog post
<https://whispersystems.org/blog/contact-discovery/>). adelante,
Boskote

"For TextSecure, however, we’ve grown beyond the size where that remains
practical, so the only thing we can do is write the server such that it
doesn’t store the transmitted contact information, inform the user, and
give them the choice of opting out."
This suggests that hashing is used. It is not secure, but the secure
protocols were (and probably still are) at the time of writing
prohibitively inefficient.
<https://moderncrypto.org/mail>https://moderncrypto.org/mail
-archive/messaging/2015/001827.html

Post by a***@tuta.io
Also, in the Signal Wiki, it says: In order to determine which contacts
are also Signal users, cryptographic hashes
<https://en.wikipedia.org/wiki/Cryptographic_hash_function> of the
user's contact numbers are periodically transmitted to the server.[41]
Source [41] links to your link, Jani. However, that blog post does not
say that Signal uses hashes, only that hashing is a solution that doesn't
work. Is this an error in the Wiki?
source: <https://en.wikipedia.org/wiki/>https://en.wikipedia.org/wiki/
Signal_%28software%29#Servers
--
Securely sent with Tutanota. Claim your encrypted mailbox today!
https://tutanota.com
Jani,
Thanks for the link. It touches on the hashing issue. However, it
doesn't explain what Signal's process is for contact discovery. Is there an
explanation somewhere?

Post by a***@tuta.io
What information about my contacts does the Signal server collect?
Here's my understanding of the process: I create an account with my number,
which is stored as a hash on the Signal server. A friend installs Signal,
and the Signal network scans his contact list, encrypting it first. His
contacts' numbers are hashed and checked against the server to find any
matches. The server sees my number hash in the server and in his contact
list, so I'm added to his Signal contacts. Therefore, at no point does the
Signal server store anything but phone # hashes.
Is this accurate? If not, would you please explain or direct me to an
explanation? I was discussing this with someone, and they warned me that if
numbers are being hashed in the server, they're easily crackable. He said
that modern GPUs can calculate up to 200 million hashes per second which
means they could have a complete hashtable of all possible phone numbers
in seconds.

<https://whispersystems.org/>https://whispersystems.org/
blog/contact-discovery/