I would like to know why government agencies need the help of WhatsApp for decryption. As can be seen in this article.
They asked for WhatsApp help to decrypt the messages. They did more complicated decryption tasks. What's so special with WhatsApp?
-
3Funfact: WhatsApp uses Signal's protocol for android-to-android messages, making it impossible to decrypt past messages without device access and requiring active interception and an ignored warning to intercept an ongoing communication. – SEJPM Mar 13 '16 at 21:11
Add a comment
|
they just haven't leaked-out their encryption keys to government agencies. For now, at least. Global CA's like Comodo have "unexpected leaks" from time to time, and only a fool will beleive that they're accidents...
answered Mar 13 '16 at 15:15
What makes you say "they did more complicated decryption tasks"?
This speaks to a larger question of "Why do government agencies ask for help in decryption?" The most common two reasons are chain of custody/saving face and they actually can't do it. Government agencies are good generally, but they're not superpowers.
Look at Apple vs FBI for my first reason: They could ask the NSA, but they haven't. It'd be a breach of the NSA's actual directive but it's not like they haven't surpassed their directive in the future. It'd draw public scrutiny and may encounter issues in the court if they cite it as evidence.
If a major company develops top tier security, they can't just constantly pull a private key to decrypt it or a major 0day exploit out of their a**. WhatsApp may have more information regarding their private keys and the like assuming they're even all signed with a private key WhatsApp is in possession of, or they sincerely may have taken themselves out of the equation as a trusted authority and made the process autonomous, in which case WhatsApp cannot help.
What Alexey is referring to is the fact that this would be more common if it weren't for the fact that so many companies just fold to government pressure and hand everything over.
WhatsApp now uses end-to-end encryption in order to secure user communications.
WhatsApp has been blocked numerous times in Brazil in retaliation for failing to decrypt a suspect's messages when ordered by judges. Their explanations for why they are unable to comply seem consistent with their encryption technology: they don't store any communications and even if they did they would not be able to decrypt them because they would not have the keys.
I would like to know why government agencies need the help of WhatsApp for decryption.
Because, in the past, WhatsApp probably held the encryption keys used to encrypt user communications. Authorities would order WhatsApp to decrypt user data using the keys in its possession.
With end-to-end encryption, the keys are stored in each user's device. This essentially makes it impossible for WhatsApp to help the authorities. They'd have to compromise their own security in order to that.
So now I think the better question is whether WhatsApp is able to help. There is at least one concrete instance where a government did asked them for help with decryption and WhatsApp was unable to help them. If the excruciating courtroom drama that resulted is any indication, the answer is no. The most recent development featured a judge basically ordering WhatsApp to backdoor its own security.
