IS there any way to verify the encryption from remote or so? Like my friend is 1000 miles away from me the physically QR Code scanning is not possible. So is there any way to verify the same?
closed as off-topic by Graham Hill, Tobi Nary, RoraΖ, Steffen Ullrich, Ohnana Apr 6 '16 at 15:28
- This question does not appear to be about Information security within the scope defined in the help center.
If you feel confident enough that you can recognize his or her voice over the phone, you can simply compare the security code (the long string of numbers) over the phone. Or via a video call, which is even harder (if not impossible) to fake for a potential man in the middle. Or if you already confirmed PGP keys, you can exchange the security code (or the QR code) via e-mails using PGP signatures.
As outlined in their paper:
Verifying Keys WhatsApp users additionally have the option to verify the keys of the other users with whom they are communicating so that they are able to confirm that an unauthorized third party (or WhatsApp) has not initiated a man-in-the-middle attack. This can be done by scanning a QR code, or by comparing a 60-digit number.
The 60-digit number is computed by concatenating the two 30-digit numeric fingerprints for each user’s Identity Key. To calculate a 30-digit numeric fingerprint:
- Iteratively SHA-512 hash the public Identity Key and user identifier 5200 times.
- Take the first 30 bytes of the final hash output.
- Split the 30-byte result into six 5-byte chunks.
- Convert each 5-byte chunk into 5 digits by interpreting each 5-byte chunk as a big-endian unsigned integer and reducing it modulo 100000.
- Concatenate the six groups of five digits into thirty digits.
Now, how you compare that 60 digit number is entirely up to you, but in this day and age there are many, many separate channels you can use to do this.