Nebuchadnezzar: Entering (and Exiting) the Matrix: A retrospective on my first year and a half of research: Dan Jones

I am still working on the ‘Summer’ project I started at the end of my training year. Whilst I believe this is a common occurrence in the CDT, it can still be an occasional source of anxiety!

Before I explain what’s taken me so long, I’ll quickly explain the project. I worked with my now supervisor, Martin Albrecht, to study Matrix, a protocol for end-to-end encrypted group messaging (think WhatsApp group chats). The protocol has over 80 million users, and is well used among the open source and free software communities as well as several governmental organisations. They have a presence in government organisations within France, Germany and Sweden. This includes healthcare services and, in the case of Germany, their military.

Our initial goal was to analyse the protocol. We would study it, precisely define its intended security goals, then determine whether it fulfils those goals. It’s in the final step that we attempt to write a security proof. This would be the first time I would work on a cryptography project and I was excited to give it a go.

Development of Matrix started in 2014, meaning that its design is relatively straightforward (cryptographically speaking). Especially when compared to modern group messaging protocols, such as the IETF’s forthcoming Message Layer Security. It seemed like the perfect candidate with which to cut my cryptographic teeth. What we did not expect, however, was the breadth of the protocol. We soon realised that covering the whole protocol in the summer project was not feasible. Instead, we decided to focus on a single component: the Megolm ratchet. By the end of the summer we had a formal description of the Megolm ratchet, a precise definition of its security goals, and a proof that it fulfils them.

As I transitioned into my first year of research, Martin introduced me to Benjamin Dowling who soon joined the project. With one more person on-board (and some added expertise) we got started on a more complete analysis of the whole protocol. Our first job was to synthesise the various specifications and documents that define it into a single precise description; this would form the basis of our analysis. In addition to documentation, the Matrix foundation also provides libraries to help others develop new software using the protocol. This proved a useful source for resolving ambiguities in the specification. It is sometimes the case that the secure way of completing a task is left implicit in written specifications; checking the source code is an easy way to double check our interpretation.

It is at this point where the project went a little off-track. We found several points of ambiguity in the documentation that could lead to security issues if implemented incorrectly. When we checked the source code, our hunch was right. There was a vulnerability! And another! Before long we had found six potential vulnerabilities: some in the specification, others in the source code. Often their root cause sat somewhere in-between.

Being a newbie, I wasn’t particularly confident in these findings (thinking such things as “Maybe I’ve just misunderstood the code?”). To quell these thoughts, we created proof-of-concepts for the more intricate attacks. That is, we implemented each attack in code, spun up a test server and ran the attacks. After verifying they worked, we disclosed our findings to the Matrix development team. During this time, we were contacted by Sofía Celi who was also studying Matrix and had found a similar set of issues. We joined together, collated our findings and disclosed the new vulnerabilities to Matrix. This work turned in to my first paper and has been accepted to the 44th IEEE Symposium on Security & Privacy.

It turns out that there can be a lot of public relations work involved when disclosing security vulnerabilities. After we agreed upon a public release date with Matrix, we prepared an explanatory website and even emailed a few journalists we thought would be interested. This is not something I would have thought to do, but my more experienced co-authors certainly did. Thanks to them this work was picked up in more places than I could have imagined and led to a bunch of new opportunities. It was featured in Ars Technica (syndicated to Wired) and The Register. We were fortunate enough to be invited to speak at Blackhat Europe, an IETF meeting and we even made a podcast appearance.

During much of this time, work on our analysis of the protocol was mostly stalled. This is something I was worried about. In fact, I initially resisted investigating these attacks to ensure we finished our analysis work first. In hindsight, going off-track to follow a lead was the best decision we could have made. All of this is to say, having the time and freedom to pursue new and interesting ideas that come up is a rare privilege that pursuing a PhD gives you. Use it! Regarding the original project, you’ll be pleased to know we have completed our security analysis of Matrix and thus, my summer project is now complete. Well, almost…

You can view the Blackhat presentation here

1.Now a lecturer at the University of Sheffield, Benjamin Dowling was previously a post-doc at the ISG!
2.The attacks were tested on local copies of the server and client software. Not in the real world!
3 Sofía Celi is a cryptographer at Brave Software.