A Case Study On End-to-End Encryption Used In Whatsapp
WhatsApp, since its
inception six years ago, has quickly grown into a global phenomenon, becoming
one of the most popular mobile based communications applications in the world
today. With a user base that eclipsed one billion in February, WhatsApp
provides a service that potentially endangers the privacy of over 10% of the
entire human population. In order to address these security concerns, it was
announced in early April that the application now offers full end to end
encryption (E2EE) , meaning all messages, calls, and files, both in a One on
one and group setting, are completely secure from hackers or even WhatsApp itself.
In addition to this announcement, WhatsApp released a technical white paper
detailing the newly incorporated security protocol, from session establishment
to actual message encryption, all to support its claim of achieving E2EE. We
are here to examine the low level technical features of each component of the
proposed security scheme as well as the algorithms that were utilized,
ultimately analysing if the system as a whole does indeed provide the level of
security that it takes credit for.
2.Need to Encryption
A) Messages were sent as plain text between two
clients.
B) All the messages were stored in the server until
the messages are read by the recipient.
C) WhatsApp's adoption of end-to-end encryption
follows Apple's debate with the FBI over the unlocking of a terrorist's iPhone.
During the dispute Jan Koum, WhatsApp’s co-founder, said that he supported
Apple's position and admired its "efforts to protect user data".
D) In March it was revealed that WhatsApp had been
targeted by court orders asking to access information it holds. 
3.End to End Encryption used in Whatsapp
WhatsApp Messenger allows people to exchange
messages (including chats, group chats, images, videos, voice messages and
files) and make WhatsApp calls around the world. WhatsApp messages, voice and
video calls between a sender and receiver that use WhatsApp client software
released after March 31, 2016 are end-to-end encrypted.
The Signal
Protocol, designed by Open Whisper Systems, is the basis for WhatsApp’s
end-to-end encryption. This end-to-end encryption protocol is designed to
prevent third parties and WhatsApp from having plaintext access to messages or
calls. What’s more, even if encryption keys from a user’s device are ever
physically compromised, they cannot be used to go back in time to decrypt
previously transmitted messages.
WhatsApp partnered with Open Whisper Systems for the cryptographic
portions of messaging. The process involves a variation of Off the Record
(OTR), Perfect Forward Secrecy (PFS), and the Double Ratchet Algorithm (DRA).
3.Term And Technology Used
A)Public Key Types
Identity Key Pair – A long-term Curve25519 key
pair, generated at install time.
Signed Pre Key – A medium-term Curve25519 key pair,
generated at install time, signed by the Identity Key, and rotated on a
periodic timed basis.
One-Time Pre Keys – A queue of Curve25519 key pairs
for one time use, generated at install time, and replenished as needed.
B) Session Key Types
Root Key – A 32-byte value that is used to create
Chain Keys.
Chain Key – A 32-byte value that is used to create
Message Keys.
Message Key – An 80-byte value that is
used to encrypt message contents. 32 bytes are used for an AES-256 key, 32
bytes for a HMAC-SHA256 key, and 16 bytes for an IV.
C) Initiating Session Setup
To communicate with another WhatsApp user, a
WhatsApp client first needs to establish an encrypted session. Once the session
is established, clients do not need to rebuild a new session with each other
until the existing session state is lost through an external event such as an
app reinstall or device change.
To establish a session:
1. The initiating client (“initiator”) requests the
public Identity Key, public Signed
Pre Key, and a single public One-Time Pre Key for
the recipient.
2. The server returns the requested public key
values. A One-Time Pre Key is only used once, so it is removed from server
storage after being requested.If the recipient’s latest batch of One-Time Pre
Keys has been consumed and the recipient has not replenished them, no One-Time
Pre Key will be returned.
3. The initiator saves the recipient’s Identity Key
as Irecipient, the Signed Pre
Key as Srecipient, and the One-Time Pre Key as
Orecipient.
4. The initiator generates an ephemeral Curve25519
key pair, Einitiator.
5. The initiator loads its own Identity Key as
Iinitiator.
6. The initiator calculates a master secret as
master_secret = ECDH(Iinitiator, Srecipient) || ECDH (Einitiator, Irecipient)
|| ECDH(Einitiator, Srecipient) || ECDH(Einitiator, Orecipient).If there is no
One Time Pre Key, the final ECDH is omitted.
D) Exchanging Messages
Once a session has been established, clients
exchange messages that are protected with a Message Key using AES 256 in CBC
mode for encryption and HMAC- SHA256 for authentication. The Message Key
changes for each message transmitted, and is ephemeral, such that the Message
Key used to encrypt a message cannot be reconstructed from the session state
after a message has been transmitted or received. The Message Key is derived
from a sender’s Chain Key that “ratchets” forward with every message sent.
Additionally, a new ECDH agreement is performed with each message roundtrip to
create a new Chain Key.This provides forward secrecy through the combination of
both an immediate “hash ratchet” and a round trip “DH ratchet.”
E) Calculating a Message Key from a Chain Key Each
time a new Message Key is needed by a message sender, it is calculated as:
1).Message Key = HMAC-SHA256(Chain Key, 0x01).
2).The Chain Key is then updated as Chain Key = HMAC-SHA256(Chain Key, 0 x02).
This causes the Chain Key to “ratchet” forward, and also means that a stored
Message Key can’t be used to derive current or past values of the Chain Key.
Comments
Post a Comment