2

The news is out, WhatsApp switched on encryption for a billion people. It supports all devices and encrypts texts, photos, videos and calls.

There are so many questions that just came to my mind that I really would like to get answered. Since the news is so fresh, there isn't any more information online yet. I do hope that there are not too many questions in this one question format.

  1. How does such a system work to support all devices?
  2. What encryption do they use? PGP? RSA/AES-hybrid? Other?
  3. How strong is the encryption and when do the keypairs even get generated?
  4. Why can group chats be encrypted as well as 1:1 conversations?
  5. When and how does the verification of the public key happen?
  6. Where is the private key stored?
  7. Is it possible to extract the private key?
  8. What happens when I change my phone?
  9. Are backups encrypted too?
  10. Is supporting the past unencrypted chat history not a security concern? Or do they even encrypt the chat history?
  11. Is the design of the system really secure when the app sais

"when possible, the messages you send and your calls are secured with end-to-end encryption"

?

Thank you very much. I know that some points might only be speculation, but a good thought on how it could be implemented is just as fine.

closed as too broad by Steffen Ullrich, Xander, Stephane, Ohnana, Mike Ounsworth Apr 6 '16 at 2:06

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    > Read an in-depth technical explanation of WhatsApp's end-to-end > encryption, developed in collaboration with Open Whisper Systems. Some of your questions are answered here: whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf – Mirsad Apr 5 '16 at 22:31
  • 1
    The way you asked this, it would take a small textbook (and a great deal of guesswork) to answer. I'm voting to close this question as "too broad". That said, have a look at this related question: security.stackexchange.com/q/119573/61443 – Mike Ounsworth Apr 6 '16 at 2:06
  • That's what I expected. Thank you for your comments and hints. – ST2OD Apr 6 '16 at 6:16