SOURCES - AUDIT SÉCURITÉ MESSAGERIES 2026
Rapports d'Audit & Cryptographie
Signal
- Signal Protocol Specification: https://signal.org/docs/specifications/
- libsignal Documentation: https://github.com/signalapp/libsignal
- Audits historiques:
- Multiple formal analyses (2016-2024) validant Double Ratchet
- EFF rating: protocole solide
Element/Matrix
- NCC Group Audit (2016): "Matrix Olm Cryptographic Review"
- Découverte: unknown key-share attack en Megolm (group chats)
- Statut: Connu et documenté, mitigations en place
- Lien: https://www.nccgroup.com/research-blog/public-report-matrix-olm-cryptographic-review/
- BSI CAOS Audit (2023-2024): "Security Analysis of Matrix by MGM Security Partners"
- Résultat: Zero critical vulnerabilities
- 3 low-severity findings (media upload, HSTS, X-Frame-Options)
- Lien: https://element.io/blog/bsi-funds-security-analysis-of-matrix/
- Academic Formal Analysis (2024): "A Mechanized Formal Analysis of the Matrix Cryptographic Core"
- Analyse: Olm/Megolm properties under threat model
- Source: arxiv.org/pdf/2408.12743.pdf
- Matrix Olm/Megolm Spec: https://matrix.org/docs/matrix-concepts/end-to-end-encryption/
SimpleX
- Trail of Bits Security Assessment (2022):
- Issues: 2 medium, 2 low severity
- X3DH KDF not applied (high difficulty exploit)
- Attack requires compromising private keys + break-in recovery
- Status: 3 of 4 fixed in v4.2
- Lien: https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html
- Issues: 2 medium, 2 low severity
- SimpleX Protocol Whitepaper: https://simplex.chat/docs/simplex.html
- Design: No global user identifiers (unique feature)
- PQKE: Continuous post-quantum key exchange
- Threat model: Detailed analysis
Session
- Quarkslab Audit (2021):
- Finding: PFS absent in Session Protocol
- Status: Intentional design choice (not vulnerability)
- Session's response: Layers of anonymity compensate (onion routing, no phone)
- Lien: https://getsession.org/fr/faq
- Session Technical Documentation:
- Ed25519 key pairs, X25519, AES-GCM encryption
- Service Node staking (15k Oxen = Sybil attack mitigation)
- 2025 Update: PFS + Post-Quantum (ML-KEM NIST standard) implemented
Telegram
- Royal Holloway / ETH Zurich Analysis (2016-2024):
- 4 vulnerabilities discovered:
- Message alteration (trivial)
- Plaintext recovery (medium difficulty)
- MITM attack (rare, very difficult)
- Signature validation issues
- Status: Patched in MTProto 2.0 (partially)
- Lien: https://mtpsym.github.io
- 4 vulnerabilities discovered:
- Academic Symbolic Verification (Zhong et al, 2021):
- Result: "MTProto 2.0 does not present logical flaws"
- Caveat: Implementation & side-channel vulnerabilities possible
- Rapport: "Automated Symbolic Verification of Telegram's MTProto 2.0"
- ESET Analysis (2025):
- Issue: MTProto not open for full independent audits (unlike Signal, others)
- Impact: Cannot assess current security comprehensively
- Lien: https://www.eset.com/blog/en/home-topics/privacy-and-identity-protection/telegram-privacy-explained
- Important Stories Investigation (2024):
- Finding: Kremlin investors in Telegram (VTB Capital $1B+, multiple oligarchs)
- Durov visits Russia 50+ times despite "exile" claim
- Lien: https://www.important-stories.com/
Olvid
- ANSSI CSPN Certification (2021-2024):
- Certification Level: CSPN (standard français)
- Auditor: Synacktiv (centre d'évaluation agréé)
- Finding: Zero exploitable vulnerabilities
- Fonction évaluées: Auth, chiffrement messages/joints/appels, backup
- Lien: https://messervices.cyber.gouv.fr/visas/ANSSI-CSPN-2021-12-rapport.pdf
- Rapport technique: https://olvid.io/assets/documents/Synacktiv-Olvid-CSPN-Olvid-0.8.2-RTE-public.pdf
- Olvid FAQ (2025):
- Certifications protocolaires toujours valides (aucun changement depuis)
- Nouvelles fonctionnalités = pas de remise en question base crypto
- Lien: https://www.olvid.io/faq/questions-d-actualite/
XMPP
- OMEMO Specification (XEP-0384):
- Based on: Double Ratchet Algorithm
- Features: Forward secrecy, deniability, multi-device
- Limitation: Forward secrecy only when both parties online
- Lien: https://xmpp.org/extensions/xep-0384.html
- Radically Open Security Analysis (2016):
- Assessment: OMEMO protocol solid
- Client implementations: Variable security
- Lien: prism-break.org/fr/protocols/omemo
Données de Métadonnées & Surveillance
Telegram + Kremlin Links
- "Telegram, the FSB, and the Man in the Middle" (Investigative Journalism, June 2025):
- Infrastructure: Vladimir Vedeneev companies manage Telegram infrastructure
- SORM Connection: FSB access to GlobalNet/DATAIX networks
- Impact: MITM attacks on metadata (who talks to whom, when, where)
- Coverage: Ukraine, Belarus networks compromised (90% Ukraine, 100% Belarus 2019)
- "Telegram: From libertarian myth to Kremlin influence tool" (DebuNK Café, Nov 2025):
- Funding: 4B$ raised, opaque investors
- Kremlin ties: VTB Capital ($1B+), Yuri Milner, Abramovitch, others
- Durov visits: 50+ trips to Russia despite exile narrative
- TON blockchain failure: SEC fine $18.5M, $1.2B reimbursement
- Dettes: $2 billion corporate debt (per Durov to French authorities Dec 2024)
- Lien: https://debunkcafe.fr/telegram-mythe-libertaire-outil-influence-kremlin/
Signal Metadata
- Mozilla Foundation Privacy Review (2025):
- Data collection: Phone number only (stored server)
- Compliance: FOIA requests (confirms if number = Signal user + last login)
- Mitigation: Sealed Sender (hides sender in messages)
- Link proxy: Google Maps API exposes IP (for link previews)
- Lien: https://www.mozillafoundation.org/fr/nothing-personal/signal-privacy-review/
Métadonnées en général
- Vectra AI Analysis (2025):
- 6 metadata types exploitable
- Network correlation analysis possible
- IMDS cloud metadata attacks (49% EC2 instances non-conformes IMDSv2)
- Lien: https://fr.vectra.ai/topics/metadata
Open Source & Reproductibilité
Signal
- GitHub Repos:
Element/Matrix
- GitHub:
- Synapse server: https://gitlab.matrix.org/matrix-org/synapse
- Element Web: https://github.com/element-hq/element-web
- Clients: https://github.com/element-hq
SimpleX
- GitHub:
- simplexmq library: https://github.com/simplex-chat/simplexmq
- Messenger apps: https://github.com/simplex-chat/simplex-chat
- License: AGPL3
Session
- GitHub:
- Session: https://github.com/oxen-io/session-android
- Session Desktop: https://github.com/oxen-io/session-desktop
- libsession-util: https://github.com/oxen-io/libsession-util
XMPP
- Standard & Clients:
- XEP Protocol: https://xmpp.org/extensions/
- Popular servers: Prosody, ejabberd, openfire
- Clients: Gajim, Conversations, Converse.js, Dino
CVE & Vulnérabilités
CVE Databases
Specific CVEs
- Telegram-related:
- CVE-2025-52572 (Hikka userbot)
- MTProto protocol flaws (2016, unpatched in some aspects)
- Signal: No known critical CVEs
- Element: E3.1-E12.1 findings from BSI (low severity)
- SimpleX: Trail of Bits findings (resolved)
- XMPP: Minimal history
Juridiction & GDPR Compliance
GDPR References
- https://gdpr-info.eu/
- https://www.cnil.fr/ (French data protection)
Signal Foundation
- Location: Delaware, USA
- Transparency Report: https://signal.org/blog/
- FOIA Compliance: Documented US government requests
Olvid
- ANSSI Certification: https://www.anssi.gouv.fr/
- Rapport CSPN: Public domain French certification
Telegram
- SORM (Russian Surveillance): System accessible via DATAIX/GlobalNet
- Durov Arrest (France, Aug 2024): Security/trafficking concerns
Architecture & Decentralization Studies
Matrix Federation
- Federation Spec: https://matrix.org/docs/spec/server_server/
SimpleX Decentralization
- SMP Design: No global identifier namespace
- Queue rotation: Automatic migration between servers
- User control: 4+ independent relays per conversation
Session Decentralization
- Service Nodes: 2100+ community-operated
- Oxen blockchain: Proof-of-stake security model
- Sybil mitigation: 15k Oxen stake requirement
2025-2026 Developments
Signal
- Post-quantum cryptography in development
- Sealed sender refinements ongoing
Element/Matrix
- MLS protocol (IETF standard) adoption in progress
- End-to-end encryption improvements
SimpleX
- Video/file transfers (1GB via XFTP)
- Incognito groups (beta)
- Continuous PQKE implementation
Session
- V2 Session Protocol live (PFS restored, PQKE added)
- Service Node improvements
Olvid
- Continued ANSSI certification maintenance
- New feature development within certified framework
Additional Resources
Academic Papers
- "Double Ratchet Algorithm" (Perrin & Marlinspike)
- "A Mechanized Formal Analysis of Matrix" (arxiv)
- "Security Analysis of Telegram" (Royal Holloway/ETH Zurich)
Industry Standards
- NIST Post-Quantum Cryptography: ML-KEM standard approval (2024)
- IETF MLS: Modern standardized group chat encryption
Privacy Organizations
- EFF Secure Messaging Scorecard: https://www.eff.org/
- Restore Privacy: Messaging app comparisons
- Privacy Guides: https://www.privacyguides.org/
Canal Telegram - Discussions Privacy & Cyber
Groupe SimpleX - Alternative privacy-first à Telegram