2

I am reading design documents of an internal Whats-app like chat application.
Developers are planning to use asymmetric encryption to encrypt all messages.

Every user will have a public/private key pair and for every new chat a chat-public and a chat-private key will be generated. Keys will be delivered to relevant parties via a central server.
When a user sends a message, the message will be encrypted with user private and chat public keys. Receiver will decrypt the message using sender's public and chat's private key.
This looks fine but most popular chat apps are using PKI to exchange a shared key and continue with symmetric encryption.

Is there a reason I should argue against asymmetric method and offer using a symmetric encryption algorithm?

  • The chat key pair is unique to each user or do they both get both keys? – Jens Krüger Jul 24 at 6:06
  • @JensKrüger They get both keys. – mk_ Jul 24 at 6:13
  • Are the Key generated Server side or Client side? – Jens Krüger Jul 24 at 6:18
  • User key pairs are generated on clients, chat keys are generated on the server. – mk_ Jul 24 at 6:21
  • So you are transmitting the chat private key to the users from the server? – Jens Krüger Jul 24 at 6:22
4

Yes, there's a reason; public key encryption is very slow and CPU-intensive, and not at all suitable for encrypting chat data, which may well include images, audio or video as well as text. That's why wherever it's used, it's only used to transmit a shared symmetric encryption key which is then used to encrypt the actual content. But in any case, it's never a good idea to roll your own cryptography. Just use TLS, which is designed for this kind of use case. You'll need to get every instance of the user app to upload its public key to your server, so that other users can check the server to verify that they're talking to the right person and not being hit with a man-in-the-middle attack.

0

Reasons to use symmetric encryption in your case:

  • It is way faster then asymmetric encryption
    Asymmetric encryption is quite expensive when it comes to computing time.
  • You already have everything in place to use symmetric encryption.
    You are distributing Private Keys anyway so why not just distribute a symmetric key.
  • Asymmetric encryption is not well suited for the encryption of large chunks of data
    Chat my be use to transmit more that simpel text e.g. Pictures, Voice Mails...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.