TY - CONF
T1 - Alice and bob, who the foci are they?
T2 - 7th USENIX Workshop on Free and Open Communications on the Internet, FOCI 2017, co-located with USENIX Security 2017
AU - Espinoza, Antonio M.
AU - Tolley, William J.
AU - Crandall, Jedidiah R.
AU - Hilts, Andrew
AU - Crete-Nishihata, Masashi
N1 - Funding Information:
This material is based upon work supported by the U.S. National Science Foundation under Grant Nos. #1314297, #1420716, #1518523, and #1518878. Antonio Espinoza was supported by the Open Technology Fund Information Controls Fellowship Program. This research is part of the Net Alert (https://netalert.me) project funded by the Open Technology Fund. We would like to thank Jeffrey Knockel for commenting on drafts, providing code for modifying packets in flight, and implementing LEGY HMAC in python source code. We also thank Ramy Raoof for inspiring the title of our paper, and the LINE security team for comments on drafts and their engagement during the disclosure process. We are also grateful to the anonymous FOCI reviewers and our shepherd, Nick Weaver, for valuable feedback.
Publisher Copyright:
© 2017 7th USENIX Workshop on Free and Open Communications on the Internet. All rights reserved.
PY - 2017
Y1 - 2017
N2 - End-to-end encryption (E2EE) is becoming a standard feature in many popular chat apps, but independent security assessments of these implementations are limited. In this paper we provide the first independent analysis of E2EE features in LINE, a messaging application popular in Asian markets, and identify a replay attack and an attack on a lack of forward secrecy. Based on our analysis and communications with LINE about the vulnerabilities we discuss challenges and new research directions to better bridge vendors, researchers, and end-users around security issues.
AB - End-to-end encryption (E2EE) is becoming a standard feature in many popular chat apps, but independent security assessments of these implementations are limited. In this paper we provide the first independent analysis of E2EE features in LINE, a messaging application popular in Asian markets, and identify a replay attack and an attack on a lack of forward secrecy. Based on our analysis and communications with LINE about the vulnerabilities we discuss challenges and new research directions to better bridge vendors, researchers, and end-users around security issues.
UR - http://www.scopus.com/inward/record.url?scp=85084161706&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85084161706&partnerID=8YFLogxK
M3 - Paper
AN - SCOPUS:85084161706
Y2 - 14 August 2017
ER -