Matrix with Martin Albrecht and Dan Jones
Security Cryptography Whatever
00:00
A C Attack to Inject a Megalm Session
You establish a semi-trusted channel. And then you can now send, you know, start negotiating more key material over the semi- Trusted channel. But there was a bug that forgot that this was derived from the semi-Trusted channel because there's a protocol confusion. It was not supposed to arrive via a megal, but only via old. You send it over old when they accept this and say like, now I'm upgrading kind of like how much I trust the session in question. The attacker can outperform a genuine client in convincing another party that this key material is most is definitely genuine.
Transcript
Play full episode
