3

It looks like Whatsapp stores encryption keys on the phone side, but I wonder if there are any details on how they do it? Do they use Android Keystore / Secure Enclave? Or something else?

The main concern is whether those storages are safe in case of rooted device.

Improve this question
9
  • The encryption key is stored in the keychain. Most keychain items can be easily accessed with phone breaker software.
    – Overmind
    Nov 18, 2019 at 10:57
  • @Overmind so understanding this, Whatsapp still choosing this approach probably means it's the most practical way to do it, correct?
    – Maxim Velesyuk
    Nov 18, 2019 at 11:15
  • 1
    Long story short: they are intentionally being prevented from developing something that can never be broken.
    – Overmind
    Nov 18, 2019 at 11:40
  • @Overmind you are saying like there is another interested party involved (like government)?
    – Maxim Velesyuk
    Nov 18, 2019 at 11:42
  • 1
    Exactly. London, UK: Westminster Bridge attacker Khalid Masood allegedly sent a WhatsApp message that cannot be accessed by the police because it was encrypted. “We need to make sure that organizations like WhatsApp — and there are plenty of others like that — don’t provide a secret place for terrorists to communicate with each other,” said British Home Secretary Amber Rudd, trying to urge WhatsApp to provide a backdoor for British intelligence and law enforcement.
    – Overmind
    Nov 18, 2019 at 12:04

1 Answer 1

Reset to default
2

The encryption key is stored in the keychain. Most keychain items can be easily accessed with various phone breaker software.

Any device made by a large company cannot be guaranteed to be secure,unless you make your own hardware and software and communicate via encrypted protocols. Only then you can guarantee that your systems are safe. Even new encryption is intentionally designed not to be 100% secure.

The access to Whatsapp keys does enable access even to deleted messages. There are two ways for a user to delete WhatsApp messages. The messages can be deleted one by one or cleared all at once by using the clear/delete chats button. Messages deleted in either of the ways mentioned above can be recovered because deleted messages are stored in msgstore.db-wal, which is the cache file for message storage. You just have to access the cache before accessing the main DB to prevent any possible over-writes of it.

Therefore, Smart Phone Forensic Systems and Phone breakers support fully the recovery of keys and any data that was encrypted with them, including deleted data.

Improve this answer
4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.