Last week Whatsapp introduced the end to end encryption to prevent man in the middle intercept/attack. The company claims that the data such as text, call, video, images and documents are stored nowhere in their server, only the concerned devices will be able to store or decrypt the data. But still the "Quick Image/Video upload" is working fine. The basic idea behind "Quick Image/Video upload" is to cache a copy of the uploaded images/videos in the server and when another user tries to upload the same content then the hashes are compared. If the hash matches then the server copy is used to avoid data usage. If the claim made by Whatsapp Inc. (regarding the end to end encryption without any server cache) is true then how is the "Quick Image/Video upload" still working?
Thank you @TreyBlalock for sharing whatsapp security whitepaper: https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf
Transmitting Media and Other Attachments:
Large attachments of any type (video, audio, images, or files) are also end-to-end encrypted:
- The WhatsApp user sending a message (“sender”) generates an ephemeral 32 byte AES256 key, and an ephemeral 32 byte HMACSHA256 key.
- The sender encrypts the attachment with the AES256 key in CBC mode with a random IV, then appends a MAC of the ciphertext using HMAC-SHA256.
- The sender uploads the encrypted attachment to a blob store.
- The sender transmits a normal encrypted message to the recipient that contains the encryption key, the HMAC key, a SHA256 hash of the encrypted blob, and a pointer to the blob in the blob store.
- The recipient decrypts the message, retrieves the encrypted blob from the blob store, verifies the SHA256 hash of it, verifies the MAC, and decrypts the plaintext.
Pointer number 3 is interesting here. So basically they are caching the attachments in their blob, that means they are of course storing the encrypted data in a device which isn't a communicating device.
Now the million dollar question: "Is your data safe? Is it out of reach from the authorities or the hackers?"