Practically-exploitable Cryptographic Vulnerabilities in Matrix
In this talk, we will talk about several practically-exploitable cryptographic vulnerabilities that we found in the Matrix standard for federated realtime communication and its flagship client and prototype implementation, Element. These, together, invalidate the confidentiality and authentication guarantees claimed by Matrix against a malicious server. This is despite Matrix’ cryptographic routines being constructed from well-known and studied cryptographic building blocks. The vulnerabilities we exploit differ in their nature (insecure by design, protocol confusion, lack of domain separation, implementation bugs) and are distributed broadly across the different subprotocols and libraries that make up the cryptographic core of Matrix. These vulnerabilities highlight the need for a systematic and formal analysis of the cryptography in the Matrix standard, which we will discuss a bit during the talk.
03/05/2023 14:00
Computer Systems
Sofía Celi is a cryptography researcher at Brave. She is the co-chair of the human rights and protocols considerations working group at IRTF, of the Post-Quantum Use In Protocols working group at IETF, and of the anti-fraud community group at W3C. She studied classical music and literature, but currently researches about security, cryptography and privacy on the Internet.
