←back to thread

157 points lladnar | 1 comments | | HN request time: 0.001s | source
Show context
thimabi ◴[] No.41864030[source]
WeChat using a custom protocol like MMTLS instead of sticking with something solid like TLS 1.3 is a risky move. Rolling your own crypto almost always leads to trouble. Of course, there may be ulterior motives behind Tencent’s decision, and users have little power to change it. For an app with over a billion users, that’s pretty concerning.
replies(2): >>41864971 #>>41871490 #
1. toast0 ◴[] No.41871490[source]
The article says WeChat published a document in 2016 regarding MMTLS vs TLS 1.3. The finalized RFC for TLS 1.3 is from August 2018. There were a fair number of changes in the later drafts of TLS 1.3, and little support for it in 2016, so it wasn't a solid choice they could stick to when they needed it.

The comments on MMTLS don't seem that terrible. Is it really a problem to generate an IV once per connection and then increment it? My understanding (which could be wrong) is that's pretty much how people use AES-GCM? Maybe there's a concern about how they generate the IV, but that isn't stated or was lost in translation.

The comment about forward security on shortlink is that that's all in early data, so the PSK is problematic. It'd be early data with a PSK for TLS 1.3 too; eliminating a round trip for crypto establishment is a clear goal to reduce latency in message submission. The comment about longlink connections being long feels like it'd be a problem in TLS 1.3 as well.

From what I can tell, this report is lacking details (which may be in the original chinese report), but MMTLS looks like WeChat checked out the drafts of TLS 1.3 and did something roughly equivalent, and then tunnels it through whatever connectivity they have. Could they have come back after TLS 1.3 exited draft and redo it with a standard? sure; does it gain much? probably not. Switching to QUIC (or TCP fast open) may enable a single round trip for connectivity and crypto establishment, but there needs to be a fallback to regular TCP, because not all clients have UDP connectivity.

Then there's issues with the 'business layer' encryption, but that's not MMTLS.