{"action":"closed","issue":{"url":"https://api.github.com/repos/vysheng/tgl/issues/67","labels_url":"https://api.github.com/repos/vysheng/tgl/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/vysheng/tgl/issues/67/comments","events_url":"https://api.github.com/repos/vysheng/tgl/issues/67/events","html_url":"https://github.com/vysheng/tgl/issues/67","id":115760211,"number":67,"title":"Must check received Diffie-Hellman ephemeral in MTProto","user":{"login":"prosecco","id":4587678,"avatar_url":"https://avatars.githubusercontent.com/u/4587678?v=3","gravatar_id":"","url":"https://api.github.com/users/prosecco","html_url":"https://github.com/prosecco","followers_url":"https://api.github.com/users/prosecco/followers","following_url":"https://api.github.com/users/prosecco/following{/other_user}","gists_url":"https://api.github.com/users/prosecco/gists{/gist_id}","starred_url":"https://api.github.com/users/prosecco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prosecco/subscriptions","organizations_url":"https://api.github.com/users/prosecco/orgs","repos_url":"https://api.github.com/users/prosecco/repos","events_url":"https://api.github.com/users/prosecco/events{/privacy}","received_events_url":"https://api.github.com/users/prosecco/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-08T20:58:37Z","updated_at":"2015-11-10T19:44:02Z","closed_at":"2015-11-10T19:44:02Z","body":"The code for checking the received DH ephemeral in telegram-cli seems to not follow the protocol spec.\r\nSee https://github.com/vysheng/tgl/blob/master/mtproto-utils.c#L74\r\n\r\nThis code does not verify that 1 < g_a  < p-1 as required by MTProto (See \"g_a and g_b validation\" in https://core.telegram.org/mtproto/security_guidelines).\r\n\r\nNot checking g_a enables a serious man-in-the-middle (MitM) attack: the MitM sets g_a to 1 on one side, g_b to 1 on the other side, and the shared secret is set to 1, making the channel open to the MitM (even if the two parties verify the hash of the shared secret)\r\n\r\nAm I wrong, is this check on g_a coded somewhere else? \r\nOtherwise, can we modify tglmp_check_g_a to check that 1 < g_a < p-1.\r\nThis should be fairly easy to code using BN_cmp.\r\n\r\nBest,\r\nKarthik\r\n"}}