1

As per this post on quora whatsapp messenger application seems to use public key cryptography but without a third party trusted authority to verify the public key against.

Is it true? And if it is doesn't it leaves users open to man in the middle attack unless you manually verify the keys?

3

WhatsApp uses the Signal which is conceptually much closer to PGP than TLS (and it's use of certificate authorities).

The whatsapp website has a good overview and an in depth whitepaper if you'd like to understand it better.

  • 1
    A little off topic thought : overview says " WhatsApp's end-to-end encryption ensures only you and the person you're communicating with can read what is sent, and nobody in between, not even WhatsApp. This is because your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read them. " isn't whats app the one who facilitates the exchange of public keys? So we trust whats app to not execute a man in the middle attack right? – Allahjane Jan 3 '17 at 18:05
  • @Allahjane: Check the "Verifying Keys" section of the white paper Rob linked (bottom of page 7). Basically, WhatsApp offers a security feature that allows you and your counterpart to meet in person (or use any other side channel that guarantees authenticity of the communication) to verify that WhatsApp did not execute a Man in the Middle attack against you. – Luis Casillas Jan 4 '17 at 0:58
  • @LuisCasillas well yes but then it'd be a tool for illegal communication and wouldn't be able to comply when law enforcement agencies demand chat history for investigation from whats app inc. This might bar them from operating in certain regions. I'm going too far from the topic but in theory Unless one verifies the source code it's still possible that whatsapp changes the public key during verification to fool users I know that sound like a very far fetched conspiracy – Allahjane Jan 4 '17 at 7:33
1

Whatsapp has published their security implementation.

The keys that are used by the clients for generating end to end encryption keys is fetched from Whatsapp server and not other clients. This makes it possible to test the integrity and authenticity of the keys that are received from the server. This removes the risk of a malicious attacker launching a MiTM or masquerading attack.

Having said that, the clients trust the server to send the keys that were generated by the message recipient. Whatsapp can always run a MiTM attack by sending it's own set of keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.