Record · corpus.blog/posts/01a0d0f7-436c-70cf-97c0-74d30f372f00

Security Issues in Matrix’s Olm Library

some_furry · published 14 August 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at soatok.blog Wayback capture

6blogs citing

First cited: 17 Aug 2024
Most recent: 15 Feb 2026
Rank this month: not ranked
Links from this post: 95
Words captured: 4,355

Cited by

Blog

In the post

Date

kat5.dev

week notes 2026.7 Read at the source ↗

15 Feb 2026

taggart-tech.com

Discord Alternatives, Ranked Read at the source ↗

5 Nov 2025

june.cat

I Wouldn't Use Matrix Read at the source ↗

22 Apr 2025

slugcat.systems

The rise (and future fall) of Discord Read at the source ↗

12 Dec 2024

polyproto.org

NLnet grant application Read at the source ↗

14 Oct 2024

Lotte’s Attic

Malicious homeserver can trick Element/Schildichat into revealing links in E2EE Rooms Read at the source ↗

17 Aug 2024

Links from this post

Link

Host

What Does It Mean To Be A Signal Competitor? Read at the source ↗

soatok.blog

This Would Be More Professionally Useful If Not For the Furry Art Read at the source ↗

soatok.blog

https://harubaki.carrd.co/

harubaki.carrd.co

https://soatok.blog/about/

soatok.blog

https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html

googleprojectzero.blogspot.com

https://lotte.chir.rs/2024/08/17/Missing-Salamanders-Matrix-Media-can-be-decrypted-to-multiple-valid-plaintexts-using-different-keys/

lotte.chir.rs

https://lotte.chir.rs/2024/08/17/Malicious-homeserver-can-trick-Element-Schildichat-into-revealing-links-in-E2EE-Rooms/

lotte.chir.rs

https://gitlab.matrix.org/matrix-org/olm/-/commit/6d4b5b07887821a95b144091c8497d09d377f985

gitlab.matrix.org

https://gitlab.matrix.org/matrix-org/olm/-/tree/7e0c8277032e40308987257b711b38af8d77cc69

gitlab.matrix.org

https://nvd.nist.gov/vuln/detail/CVE-2024-45191

nvd.nist.gov

https://gitlab.matrix.org/matrix-org/olm/-/blob/7e0c8277032e40308987257b711b38af8d77cc69/lib/crypto-algorithms/aes.c

gitlab.matrix.org

https://gitlab.matrix.org/matrix-org/olm/-/blob/7e0c8277032e40308987257b711b38af8d77cc69/src/crypto.cpp

gitlab.matrix.org

https://gitlab.matrix.org/matrix-org/olm/-/blob/7e0c8277032e40308987257b711b38af8d77cc69/src/cipher.cpp

gitlab.matrix.org

https://cr.yp.to/antiforgery/cachetiming-20050414.pdf

cr.yp.to

https://eprint.iacr.org/2005/271

eprint.iacr.org

https://www.schneier.com/blog/archives/2009/07/new_attack_on_a.html

schneier.com

https://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf

cs.rice.edu

https://github.com/veorq/cryptocoding?tab=readme-ov-file

github.com

https://www.bearssl.org/gitweb/?p=BearSSL;a=blob;f=src/symcipher/aes_ct.c;h=66776d9e206c92cbbf3fa799c651a3d3652bd75a;hb=HEAD

bearssl.org

https://www.bearssl.org/constanttime.html

bearssl.org

https://sfw.furaffinity.net/user/ajlovesdinos/

sfw.furaffinity.net

https://nvd.nist.gov/vuln/detail/CVE-2024-45193

nvd.nist.gov

It's 255:19AM. Do you know what your validation criteria are? Read at the source ↗

hdevalence.ca

https://gitlab.matrix.org/matrix-org/olm/-/blob/7e0c8277032e40308987257b711b38af8d77cc69/lib/ed25519/src/verify.c

gitlab.matrix.org

https://slowli.github.io/ed25519-quirks/malleability/

slowli.github.io

https://github.com/jedisct1/libsodium/blob/6e27e98777f3a6eeb233cd3280412414cead4e0d/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c

github.com

https://nvd.nist.gov/vuln/detail/CVE-2024-45192

nvd.nist.gov

https://gitlab.matrix.org/matrix-org/olm/-/blob/7e0c8277032e40308987257b711b38af8d77cc69/src/base64.cpp

gitlab.matrix.org

https://gitlab.matrix.org/matrix-org/olm/-/blob/7e0c8277032e40308987257b711b38af8d77cc69/src/inbound_group_session.c

gitlab.matrix.org

https://arxiv.org/abs/2108.04600

arxiv.org

https://github.com/Sc00bz/ConstTimeEncoding

github.com

https://github.com/Sc00bz/ConstTimeEncoding/blob/3c11bb8c8b0191980b533c8f7c16e76f69808096/base64.cpp

github.com

https://github.com/jedisct1/libsodium/blob/master/src/libsodium/sodium/codecs.c

github.com

https://leastauthority.com/blog/audits/audit-of-matrix-vodozemac/

leastauthority.com

Going Bark: A Furry’s Guide to End-to-End Encryption Read at the source ↗

soatok.blog

Why AES-GCM Sucks Read at the source ↗

soatok.blog

Threema: Three Strikes, You’re Out Read at the source ↗

soatok.blog

https://github.com/soatok/mastodon-e2ee-specification

github.com

Towards End-to-End Encryption for Direct Messages in the Fediverse Read at the source ↗

soatok.blog

It’s Time for Furries to Stop Using Telegram Read at the source ↗

soatok.blog

https://web.archive.org/web/20240606031827/https://gist.github.com/soatok/8aef6f67fec9c702f510ee24d19ef92b

web.archive.org

Against XMPP+OMEMO Read at the source ↗

soatok.blog

https://nebuchadnezzar-megolm.github.io/

nebuchadnezzar-megolm.github.io

Facebook Messenger & WhatsApp alternative Read at the source ↗

signal.org

WireGuard Read at the source ↗

wireguard.com

https://matrix.org/media/Least%20Authority%20-%20Matrix%20vodozemac%20Final%20Audit%20Report.pdf

matrix.org

https://github.com/topics/matrix-client

github.com

https://github.com/tulir/gomuks/blob/a4911282419bee6d3dbe06037f075736a9e67855/go.mod

github.com

https://github.com/mautrix/go/tree/85e0664cb441058513549a6e1e198f073bca9af4/crypto/olm

github.com

https://github.com/niochat/nio/blob/96c303e38794dfa229cb5077bd68cd4abeb6f4c7/Nio.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

github.com

https://github.com/matrix-org/matrix-ios-sdk/blob/1c4b3f5c32ed3bcf27d3404c770e000a50417352/Podfile

github.com

https://github.com/ulyssa/iamb/blob/497be7f0998d850e123362aa0ac2f8fdb8362066/Cargo.toml

github.com

https://github.com/matrix-org/matrix-rust-sdk/blob/03e1fd78a699712c0c95591c5cfad61b43d113ff/Cargo.toml

github.com

https://github.com/mirukana/mirage/blob/9a4ababd9aa59bd78ad239422918c2c4eaaf6b7d/docs/INSTALL.md

github.com

https://github.com/Pony-House/Client/blob/6af557e43684e4ab6699a21beb610801c12fbe84/package.json

github.com

https://github.com/MTRNord/cetirizine/blob/cb4e6a18b388553295e660fd6f6c167d5bd96bc0/package.json

github.com

https://github.com/mustang-im/mustang/blob/9b3fd73a6b4c3e219e2634ad804d8e388d0bc259/app/package.json

github.com

https://github.com/marekvospel/libretrix/blob/62db1f05386d9a87e94e2664dd531ea2e9d47af3/services/frontend/package.json

github.com

https://github.com/yusdacra/icy_matrix

github.com

https://github.com/matrix-org/matrix-python-sdk/blob/887f5d55e16518a0a2bef4f2d6bff6ecf48d18c1/matrix_client/crypto/olm_device.py

github.com

https://github.com/maxkratz/element-web/blob/faa602d73af40b0af456c897c0ce5900e17425d0/package.json

github.com

https://github.com/matrix-org/matrix-js-sdk/blob/develop/package.json

github.com

https://github.com/matrix-org/matrix-rust-sdk-crypto-wasm/blob/3ecc63bb5dcac5638b2b2edde8a1d607213d651f/Cargo.toml

github.com

https://github.com/NotAlexNoyle/Versi/blob/314611d6968a06aa40267d8bf65f5a30e950bbd0/package.json

github.com

https://github.com/matrix-org/matrix-js-sdk/blob/7d45947fb3dc4b0e291e03adac5348ad8eeaf32a/package.json

github.com

https://github.com/krille-chan/fluffychat/blob/e5bbb755d99c54ec051d66c9cdbf37b2f8568e18/pubspec.yaml

github.com

https://github.com/cinnyapp/cinny/blob/e54bb2e42377c49e7179f6b59669592186281eff/package.json

github.com

https://github.com/matrix-org/matrix-js-sdk/blob/bddf2b96824cd6b438531b8b1781f1500cb71eb8/package.json

github.com

https://gitlab.matrix.org/matrix-org/olm/-/blob/7e0c8277032e40308987257b711b38af8d77cc69/lib/ed25519/src/sign.c

gitlab.matrix.org

https://github.com/C2SP/wycheproof

github.com

https://github.com/amlweems/xzbot?tab=readme-ov-file

github.com

https://www.bolet.org/~pornin/2005-acns-pornin+stern.pdf

bolet.org

https://twitter.com/SwiftOnSecurity/status/832058185049579524?ref_src=twsrc%5Etfw

twitter.com

https://soatok.blog/wp-content/uploads/2024/07/SwiftOnSecurity-Nightmare-Magic-Math-Cryptography.pdf

soatok.blog

https://web.archive.org/web/20240731062107/https://pawb.social/post/9842375

web.archive.org

https://words.filippo.io/dispatches/telegram-ecdh/

words.filippo.io

https://github.com/TokTok/c-toxcore/issues/426

github.com

https://news.ycombinator.com/item?id=41249371

news.ycombinator.com

https://soatok.blog/encrypted-messaging-apps/

soatok.blog

https://github.com/tulir/gomuks

github.com

https://github.com/niochat/nio

github.com

https://github.com/ulyssa/iamb

github.com

https://github.com/mirukana/mirage

github.com

https://github.com/Pony-House/Client

github.com

https://github.com/MTRNord/cetirizine

github.com

https://github.com/nadams/go-matrixcli

github.com

https://github.com/mustang-im/mustang

github.com

https://github.com/marekvospel/libretrix

github.com

https://github.com/ierho/element

github.com

https://github.com/mtorials/cordless

github.com

https://github.com/hwipl/nuqql-matrixd

github.com

https://github.com/maxkratz/element-web

github.com

https://github.com/asozialesnetzwerk/riot

github.com

https://github.com/NotAlexNoyle/Versi

github.com

https://github.com/matrix-org/olm/issues/3

github.com