Is bob sending mixed signals?

Michael Schliep, Ian Kariniemi, Nick Hopper

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Scopus citations

Abstract

Demand for end-to-end secure messaging has been growing rapidly and companies have responded by releasing applications that implement end-to-end secure messaging protocols. Signal and protocols based on Signal dominate the secure messaging applications. In this work we analyze conversational security properties provided by the Signal Android application against a variety of real world adversaries. We identify vulnerabilities that allow the Signal server to learn the contents of attachments, undetectably re-order and drop messages, and add and drop participants from group conversations. We then perform proof-of-concept attacks against the application to demonstrate the practicality of these vulnerabilities, and suggest mitigations that can detect our attacks. The main conclusion of our work is that we need to consider more than confidentiality and integrity of messages when designing future protocols. We also stress that protocols must protect against compromised servers and at a minimum implement a trust but verify model.

Original languageEnglish (US)
Title of host publicationWPES 2017 - Proceedings of the 2017 Workshop on Privacy in the Electronic Society, co-located with CCS 2017
PublisherAssociation for Computing Machinery, Inc
Pages31-40
Number of pages10
ISBN (Electronic)9781450351751
DOIs
StatePublished - Oct 30 2017
Event16th ACM Workshop on Privacy in the Electronic Society, WPES 2017 - Dallas, United States
Duration: Oct 30 2017 → …

Publication series

NameWPES 2017 - Proceedings of the 2017 Workshop on Privacy in the Electronic Society, co-located with CCS 2017
Volume2017-January

Other

Other16th ACM Workshop on Privacy in the Electronic Society, WPES 2017
CountryUnited States
CityDallas
Period10/30/17 → …

Bibliographical note

Funding Information:
This work was sponsored by the National Science Foundation under grant 1314637.

Fingerprint Dive into the research topics of 'Is bob sending mixed signals?'. Together they form a unique fingerprint.

Cite this