Standard

In the early days of the internet, communication was by email. Originally siloed by companies like Compuserve, AT&T and Sprint so that messages could only be exchanged with others on the same system, email is now ubiquitous. Pretty much anyone can communicate with anyone else without worrying about app or device or browser.

Today there are additional methods of communicating via the internet, such as chat and voice. These new methods, however, are currently similar to early email: siloed by different vendors so that users can communicate only with other users on the same system. Matrix.org aims to change this, so that any user on one system can communicate with any user on a different system; just like email today.

Matrix: De-centralized Encrypted Real-time Communications over IPMatrix is an open standard for interoperable, decentralized, real-time communication over IP. It can be used for any type of IP communication: IM, VoIP, or IoT data. One system already operating on Matrix is the open team collaboration app, Riot. While Riot is described as "a simple and elegant collaboration environment that gathers all of your different conversations and app integrations into one single app," it can actually communicate with any user anywhere in the Matrix ecosphere.

The Matrix organization has not adopted the usual method of approaching all the big companies and trying to get the world to adopt Matrix. Instead, technical co-founder Matthew Hodgson told SecurityWeek, "We're just building it -- putting it out there on the internet as a de facto standard, and we then go and build bridges through to the existing communities. We've already got bridges through to Slack and to Skype and to IRC and various other online communities. Since the entire thing is open source, we're also getting contributors from all round the world building bridges to their own systems; such as Ericsson building bridges into their own infrastructure. Or it could be contributors who write their own bridge to link something like Telegram or Twitter -- and they basically act as a bridge to link existing silos into matrix. It's a very pragmatic way of solving the problem."

This still requires cooperation from the vendors. New companies like Slack are often open to cooperation, but larger companies like Microsoft (Skype) are not necessarily so. However, the Nadella Microsoft seems to be far more pragmatic than the Ballmer Microsoft.

"They've not fundamentally changed their spots," said Hodgson, "but at least superficially there's much more openness to this sort of technology; and the reality is that Skype is on the back foot, hemorriging users. Microsoft could do with any help it can get in trying to regain the 'cool' factor and market share. It has actually been very positive in letting us integrate with Skype. We haven't integrated Skype into Matrix, but we're in conversation -- especially since Skype is turning into a platform itself, and Microsoft realizes there is a problem of reach for its O365 customers (who have their own teams using Slack and other 'silos'). Matrix is the only common ground that can be used to link these different apps together."

He said that the only pushback Matrix has had so far has been from Facebook, "unsurprisingly," he added, since they are the incumbent and want to keep their monopoly as long as they can. But literally everyone else is amenable to pooling resources to make the world a better place. Matrix is the necessary counterbalance that can maintain the openness of the internet against monopolistic designs of big organizations."

However, the matrix itself is not enough: users, especially enterprise users, need to trust the privacy of their communications. The solution is the new beta launch of Olm encryption.

"E2E encryption is particularly important to Matrix where its decentralized nature means that a conversation can end up replicated over thousands of different servers. When the participant 'rooms' are public, that's not a problem. But if they're private rooms you get a huge attack envelope where you basically just blindly trust all of the server admins not to snoop on the content of the room." 

"In practice, he added, it's not much different to email. If I send an email to 1,000 people, it could end up on 1,000 different mail servers. But with Matrix we can and should do better. We've spent the last two years building our E2E encryption, so that if I send a message to someone on Matrix it is never stored unencrypted on any of the servers, and it can only be decrypted by the participants. It's much like WhatsApp and Allo; but we are the only one that is decentralized and not dependent on a silo or walled garden like Signal. We think it's the perfect storm for communications, combining encryption with decentralization."

To this end, Matrix has announced and launched the formal beta of the new Olm end-to-end encryption implementation across Web, iOS and Android. “With Matrix.org and Olm," commented Hodgson, "we have created a universal end-to-end encrypted communication fabric -- we really consider this a key step in the evolution of the Internet."

Olm is the Matrix implementation of the Double Ratchet algorithm designed by Trevor Perrin and Moxie Marlinspike. It was chosen, explained Hodgson in a blog post Monday, "in its capacity as the most ubiquitous, respected and widely studied e2e algorithm out there – mainly thanks to Open Whisper Systems implementing it in Signal, and subsequently licensing it to Facebook for WhatsApp and Messenger, Google for Allo, etc."

Olm has been reviewed by NCC Group (PDF). In keeping with its open philosophy, Matrix has ensured this review is available online. Several issues were discovered by NCC, including one high risk and one medium risk. The most exotic of these was an 'unknown key share attack'. "Needless to say," wrote Hodgson, "all of these issues have been solved with the release of libolm 2.0.0 on October 25th and included in today’s releases of the client SDKs and Riot."

view counter

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:


SecurityWeek RSS Feed

Vulnerable: Ubuntu Ubuntu Linux 14.10
Ubuntu Ubuntu Linux 14.04 LTS
Redhat Enterprise Linux Workstation 7
Redhat Enterprise Linux Workstation 6
Redhat Enterprise Linux Server 7
Redhat Enterprise Linux Server 6
Redhat Enterprise Linux HPC Node 7
Redhat Enterprise Linux HPC Node 6
Redhat Enterprise Linux Desktop 7
Redhat Enterprise Linux Desktop 6
Oracle Enterprise Linux 7
IBM WebSphere Application Server Liberty Profile 8.5.5
IBM Websphere Application Server 8.5.5
IBM Websphere Application Server 8.0 2
IBM Websphere Application Server 7.0 3
IBM Websphere Application Server 7.0 29
IBM Websphere Application Server 7.0 21
IBM Websphere Application Server 7.0 10
IBM Websphere Application Server 7.0 .9
IBM Websphere Application Server 7.0 .8
IBM Websphere Application Server 7.0 .2
IBM Websphere Application Server 7.0 .13
IBM Websphere Application Server 7.0 .12
IBM Websphere Application Server 7.0 .11
IBM Websphere Application Server 6.1 41
IBM Websphere Application Server 6.1 .9
IBM Websphere Application Server 6.1 .8
IBM Websphere Application Server 6.1 .7
IBM Websphere Application Server 6.1 .6
IBM Websphere Application Server 6.1 .5
IBM Websphere Application Server 6.1 .4
IBM Websphere Application Server 6.1 .33
IBM Websphere Application Server 6.1 .32
IBM Websphere Application Server 6.1 .3
IBM Websphere Application Server 6.1 .25
IBM Websphere Application Server 6.1 .23
IBM Websphere Application Server 6.1 .22
IBM Websphere Application Server 6.1 .21
IBM Websphere Application Server 6.1 .20
IBM Websphere Application Server 6.1 .2
IBM Websphere Application Server 6.1 .19
IBM Websphere Application Server 6.1 .18
IBM Websphere Application Server 6.1 .17
IBM Websphere Application Server 6.1 .15
IBM Websphere Application Server 6.1 .14
IBM Websphere Application Server 6.1 .13
IBM Websphere Application Server 6.1 .12
IBM Websphere Application Server 6.1 .11
IBM Websphere Application Server 6.1 .10
IBM Websphere Application Server 6.1 .1
IBM Websphere Application Server 6.1
IBM Websphere Application Server 8.5.5.9 - Liberty Pr
IBM Websphere Application Server 8.5.5.9
IBM Websphere Application Server 8.5.5.8 - Liberty Pr
IBM Websphere Application Server 8.5.5.8
IBM Websphere Application Server 8.5.5.7 - Liberty Pr
IBM Websphere Application Server 8.5.5.7
IBM Websphere Application Server 8.5.5.6 - Liberty Pr
IBM Websphere Application Server 8.5.5.6
IBM Websphere Application Server 8.5.5.5 - Liberty Pr
IBM Websphere Application Server 8.5.5.5
IBM Websphere Application Server 8.5.5.4 - Liberty Pr
IBM Websphere Application Server 8.5.5.4
IBM Websphere Application Server 8.5.5.3 - ~~Liberty
IBM Websphere Application Server 8.5.5.3
- IBM AIX 4.3
- Linux kernel 2.3 .x
- Microsoft Windows NT 4.0
- Sun Solaris 8_sparc
IBM Websphere Application Server 8.5.5.2 - Liberty Pr
IBM Websphere Application Server 8.5.5.2
IBM Websphere Application Server 8.5.5.1 - Liberty Pr
IBM Websphere Application Server 8.5.5.1
IBM Websphere Application Server 8.5.5.0 - Liberty Pr
IBM Websphere Application Server 8.5.0.2 - Liberty Pr
IBM Websphere Application Server 8.5.0.2
IBM Websphere Application Server 8.5.0.1 - Liberty Pr
IBM Websphere Application Server 8.5.0.1
IBM Websphere Application Server 8.5.0.0 - Liberty Pr
IBM Websphere Application Server 8.5.0.0
IBM Websphere Application Server 8.0.0.9
IBM Websphere Application Server 8.0.0.8
IBM Websphere Application Server 8.0.0.7
IBM Websphere Application Server 8.0.0.6
IBM Websphere Application Server 8.0.0.5
IBM Websphere Application Server 8.0.0.4
IBM Websphere Application Server 8.0.0.3
IBM Websphere Application Server 8.0.0.12
IBM Websphere Application Server 8.0.0.11
IBM Websphere Application Server 8.0.0.10
IBM Websphere Application Server 8.0.0.1
IBM Websphere Application Server 8.0.0.0
IBM Websphere Application Server 7.0.0.7
IBM Websphere Application Server 7.0.0.6
IBM Websphere Application Server 7.0.0.5
IBM Websphere Application Server 7.0.0.41
IBM Websphere Application Server 7.0.0.4
IBM Websphere Application Server 7.0.0.39
IBM Websphere Application Server 7.0.0.37
IBM Websphere Application Server 7.0.0.35
IBM Websphere Application Server 7.0.0.34
IBM Websphere Application Server 7.0.0.33
IBM Websphere Application Server 7.0.0.32
IBM Websphere Application Server 7.0.0.31
IBM Websphere Application Server 7.0.0.27
IBM Websphere Application Server 7.0.0.25
IBM Websphere Application Server 7.0.0.24
IBM Websphere Application Server 7.0.0.23
IBM Websphere Application Server 7.0.0.22
IBM Websphere Application Server 7.0.0.19
IBM Websphere Application Server 7.0.0.18
IBM Websphere Application Server 7.0.0.17
IBM Websphere Application Server 7.0.0.16
IBM Websphere Application Server 7.0.0.15
IBM Websphere Application Server 7.0.0.14
IBM Websphere Application Server 7.0.0.1
IBM Websphere Application Server 7.0.0.0
IBM Websphere Application Server 7.0
IBM Websphere Application Server 6.1.0.47
IBM Websphere Application Server 6.1.0.45
IBM Websphere Application Server 6.1.0.43
IBM Websphere Application Server 6.1.0.39
IBM Websphere Application Server 6.1.0.37
IBM Websphere Application Server 6.1.0.35
IBM Websphere Application Server 6.1.0.34
IBM Websphere Application Server 6.1.0.31
IBM Websphere Application Server 6.1.0.29
IBM Websphere Application Server 6.1.0.27
IBM Tivoli Storage Productivity Center 5.2.10
IBM Tivoli Storage Productivity Center 5.2.6
IBM Tivoli Storage Productivity Center 5.2.5
IBM Tivoli Storage Productivity Center 5.2.2
IBM Tivoli Storage Productivity Center 5.2.1 0
IBM Tivoli Storage Productivity Center 5.2
IBM Tivoli Storage Productivity Center 5.1.1 3
IBM Tivoli Storage Productivity Center 5.1.1
IBM Tivoli Storage Productivity Center 5.1
IBM Tivoli Storage Productivity Center 5.2.7.1
IBM Tivoli Storage Productivity Center 5.2.7
IBM Tivoli Storage Productivity Center 5.2.5.1
IBM Tivoli Storage Productivity Center 5.2.4.1
IBM Tivoli Storage Productivity Center 5.2.4
IBM Tivoli Storage Productivity Center 5.2.3
IBM Tivoli Storage Productivity Center 5.2.1.1
IBM Tivoli Storage Productivity Center 5.1.1.9
IBM Tivoli Storage Productivity Center 5.1.1.8
IBM Tivoli Storage Productivity Center 5.1.1.7
IBM Tivoli Storage Productivity Center 5.1.1.6
IBM Tivoli Storage Productivity Center 5.1.1.5
IBM Tivoli Storage Productivity Center 5.1.1.4
IBM Tivoli Storage Productivity Center 5.1.1.2
IBM Tivoli Storage Productivity Center 5.1.1.10
IBM Tivoli Storage Productivity Center 5.1.1.1
IBM Tivoli Storage Productivity Center 5.1.1.0
IBM Tivoli Monitoring 6.2.2
IBM Tivoli Enterprise portal server -
IBM Spectrum Control 5.2.11
IBM Spectrum Control 5.2.10
IBM Spectrum Control 5.2.9
IBM Spectrum Control 5.2.8
IBM Spectrum Control 5.2.10.1
IBM Liberty for Java for Bluemix 2.9
IBM Liberty for Java for Bluemix 2.7
IBM Liberty for Java for Bluemix 2.6
IBM Liberty for Java for Bluemix 2.3
IBM InfoSphere Information Server 9.1
IBM InfoSphere Information Server 8.7
IBM InfoSphere Information Server 11.5
IBM InfoSphere Information Server 11.3
IBM FastBack for Workstations Central Administration Console 7.1
IBM FastBack for Workstations Central Administration Console 6.3
IBM Content Integrator 8.6
IBM Bluemix Liberty for Java 2.3
IBM Bluemix Liberty for Java 2.2
IBM Bluemix Liberty for Java 2.1
IBM Bluemix Liberty for Java 2.0
IBM Bluemix Liberty for Java 1.9
IBM Bluemix Liberty for Java 1.8
IBM Bluemix Liberty for Java 1.7
IBM Bluemix Liberty for Java 1.6
IBM Bluemix Liberty for Java 1.5
IBM Bluemix Liberty for Java 1.3
CentOS CentOS 6
Apache Standard Taglibs 1.2.1


SecurityFocus Vulnerabilities