Introduction
The nature of modern digital communications is such that we rarely interact directly with recipients. It may appear that you and your interlocutors are exchanging messages privately, but in reality the messages are transmitted through a central server and may be stored there.
Of course, you wouldn't want your messages to be read by the server responsible for transmitting them between you and the recipient. Then end-to-end encryption (or E2EE) may be the solution for you.
End-to-end encryption is a method of encrypting messages between the recipient and the sender so that only they can decrypt the data. It dates back to the 90s, when Phil Zimmerman introduced Pretty Good Privacy (better known as PGP).
Before we talk about why you might need E2EE and how it works, let's look at how unencrypted messages are transmitted.
How are unencrypted messages sent?
Let's take a look at how a typical smartphone messaging platform works. You install the app and create an account, which allows you to communicate with other users who have done the same. You write a text and enter the recipient's nickname, and then send the message to the central server. The server sees who you addressed the message to and forwards it to the recipient.
Interaction between users A and B. To exchange messages with each other, they must transfer data through the server (S).
You are most likely familiar with the client-server model. The client (your phone) has limited functionality - the main calculations are done on the server. This also means that the server is an intermediary between you and the recipient.
In most cases, the data between A<>S and S<>B in the circuit is encrypted. An example of such encryption is the Transport Layer Security (TLS) cryptographic protocol, which is widely used to secure connections between a client and a server.
TLS and similar security solutions prevent messages from being intercepted as they pass between the client and server. These measures prevent man-in-the-middle attacks, but the message can still be read by the server. This is where the need for end-to-end encryption comes into play. If A's data were encrypted with a cryptographic key belonging to B, then the server would not be able to read or access it.
If there is no end-to-end encryption, the server may store your messages in a database along with millions of others. With large-scale data breaches happening all the time, a lack of encryption can have disastrous consequences for end users.
How does end-to-end encryption work?
End-to-end encryption ensures that no one - not even the server that connects you to other users - can access your data. We're talking about anything from plain text and emails to files and video calls.
End-to-end encryption protects data in apps like Whatsapp, Signal and (probably) Google Duo so that only the senders and intended recipients can decrypt it. End-to-end encryption begins with what is called a key exchange.
How does key exchange work in the Diffie-Hellman protocol?
The idea of a Diffie-Hellman key exchange was proposed by cryptographers Whitfield Diffie, Martin Hellman, and Ralph Merkle. It is a revolutionary cryptographic protocol that allows parties to generate a shared secret key in an open, vulnerable environment.
In other words, key generation can occur on insecure resources (even with the possibility of eavesdropping on the channel) without affecting subsequent messages. In the information age, this is especially valuable because parties do not need to physically exchange keys to communicate.
The exchange itself involves the use of random large numbers and cryptographic magic. We won't go into details. Instead, let's use the popular paint analogy. Let's say that Alice and Bob are in different hotel rooms at opposite ends of the hallway and want to use a certain color of paint together. They don't want anyone else to know which one it is.
Unfortunately, the floor is under surveillance by spies. Let's assume that Alice and Bob cannot enter each other's rooms, so they can only interact in the hallway. In the hallway, they can choose a general paint color, such as yellow. Then they take a can of yellow paint, cast themselves a piece and return to their rooms.
In their rooms, they need to mix a secret color into the yellow paint - one that no one knows about. Alice uses blue and Bob uses red. It is important that spies do not know these secret colors. Now Alice and Bob leave the rooms with their blue-yellow and red-yellow mixtures - the result of the mixing is known to the spies.
Alice and Bob exchange mixtures openly. It doesn't matter that spies see it - they can't determine the exact shade of the added colors. Remember, this is just an analogy—the actual math behind this system makes it even harder to figure out the secret “color.”
Alice takes Bob's mixture, Bob takes Alice's mixture, and they go back to the rooms. Now they're mixing in their secret colors once again.
Alice mixes her secret blue dye with Bob's red-yellow mixture, creating a red-yellow-blue color.
Bob mixes his secret red dye with Alice's blue-yellow mixture, creating a blue-yellow-red color.
Both combinations have the same colors, so they look the same. Alice and Bob successfully obtained a unique color unknown to the spies.
This is the scheme for creating a shared secret in an open environment. The difference is that in reality we are not dealing with corridors and paints, but with insecure transmission channels, public and private keys.
Message exchange
The parties can use the resulting shared secret as the basis for asymmetric encryption. Popular implementations usually include additional methods for more robust security, but these are all abstractions for the user. Once you've established an in-app connection with E2EE, encryption and decryption can only be performed on your devices (barring any serious software vulnerabilities).
It doesn't matter if you are a hacker, a telecom operator, or even a law enforcement officer. If the application actually uses end-to-end encryption, any intercepted message will appear to be an incomprehensible jumble of bytes.
➟ Do you want to start using cryptocurrency? Buy Bitcoin on Binance!
Pros and cons of end-to-end encryption
Disadvantages of end-to-end encryption
There is only one downside to end-to-end encryption, and whether it's a downside at all depends entirely on your point of view. For some, the value of E2EE is irrelevant precisely because messages cannot be accessed without the appropriate key.
Opponents argue that E2EE can be used by criminals knowing that governments and technology companies will not be able to decrypt their messages. They believe that law-abiding people do not need to keep their correspondence and telephone calls secret. This opinion is shared by many politicians, lobbying for legislation that would make it possible to use backdoors to access citizens' communications. Of course, this defeats the purpose of end-to-end encryption.
It's worth noting that applications using E2EE are not 100% secure. Messages are encrypted in transit between devices, but are accessible at endpoints such as a laptop or smartphone. This in itself is not a disadvantage of end-to-end encryption, but it is worth keeping in mind.
The message is in clear text before and after decryption.
E2EE ensures that no one can read your data during transmission. But other threats are still relevant:
Your device could be stolen: if you don't have a security code set or an attacker bypasses it, they can gain access to your messages.
Your device may be compromised and may contain malicious software that has access to messages before and after they are sent.
Another risk is that someone could gain access to the channel between you and your interlocutor using a man-in-the-middle attack. This can happen at the beginning of a conversation - when you exchange keys, you cannot be sure of the authenticity of the other party. Thus, without knowing it, you can share a secret with an attacker. The attacker receives your messages and has the key to decrypt them. He can similarly deceive your interlocutor, which means he will be able to transmit messages, read and change them at his discretion.
To avoid such an attack, many applications implement various security codes. This is a string of numbers or a QR code that you can share with your contacts through a secure channel (ideally offline). If the numbers match, then you can be sure that a third party is not tracking your interactions.
The benefits of end-to-end encryption
When used without any of the previously mentioned vulnerabilities, E2EE is undoubtedly a very valuable way to enhance privacy and security. Like onion routing, it is a technology promoted by privacy activists around the world. End-to-end encryption is easily built into the apps we're used to, meaning it's available to anyone who can use a mobile phone.
It is wrong to view E2EE as a tool that is only useful to criminals and whistleblowers. It has been proven that even the most seemingly secure companies are vulnerable to cyber attacks, resulting in unencrypted user information becoming available to attackers. Access to user data, such as sensitive messages or identity documents, can have disastrous consequences on people's lives.
If a company whose users are protected by E2EE is hacked, hackers will not be able to extract useful information about the contents of messages (if the end-to-end encryption implementation is strong). At best, they can get the metadata. This is still a concern from a privacy perspective, but it is important that the content of the messages remains unknown.
Conclusion
In addition to the comments above, it is worth saying that there are a growing number of freely distributed end-to-end tools. Apple's iMessage and Google Duo are bundled with the iOS and Android operating systems, respectively, while more privacy- and security-focused software is becoming available.
Let us emphasize again: end-to-end encryption is not a magic barrier against all forms of cyber attacks. However, with relatively little effort, you can actively use it to significantly reduce the risk you expose yourself to online. In addition to Tor, VPNs and cryptocurrencies, E2EE instant messengers can be a valuable addition to your digital privacy arsenal.
➟ Still have questions about end-to-end encryption? Head over to Ask Academy to discuss them with the community!