Practically-exploitable Cryptographic Vulnerabilities in Matrix

ePrint Report: Practically-exploitable Cryptographic Vulnerabilities in Matrix

Martin R. Albrecht, Sofía Celi, Benjamin Dowling, Daniel Jones

We report several practically-exploitable cryptographic vulnerabilities in the Matrix standard for federated real-time communication and its flagship client and prototype implementation, Element. These, together, invalidate the confidentiality and authentication guarantees claimed by Matrix against a malicious server. This is despite Matrix’ cryptographic routines being constructed from well-known and -studied cryptographic building blocks. The vulnerabilities we exploit differ in their nature (insecure by design, protocol …

authentication bugs client communication confidentiality daniel design distributed domain eprint report exploit insecure insecure by design malicious matrix nature protocol prototype report server standard vulnerabilities well-known