I have been learning the famous "SIGNAL MESSAGING PROTOCOL",
Its brilliantly designed and perfectly secure , but I doubt on its implementations

Famous messenger services like Whatsapp and Signal claim to have implemented the e2e messaging protocol for message privacy , but where are the private keys (of users) stored?

I am pretty much sure that the private key isn't stored in the user's device because , I tired sending a few messages from device "A", switched it off, installed the same app in another device "B" and logged in with the same account. If the private key had been stored in device "A" then , I must not be able to read the messages from device "B" which I had sent through device "A" , but I was able to !!

So its pretty obvious that the private keys too are stored in the app's cloud.

If the messaging service provider too had access to the private key , then they could read any sorts of information transferred between me and the receiver through the app.

And whatsapp claims the following in their signal protocol implementation

enter image description here

Are their claims true?

Just Curious.. I am beginner, please correct me if my interpretation is wrong


WhatsApp has a known security design loophole.

The private keys are indeed stored on the user's device. When you install WA on device B, you will be taking ownership of your account again.

At this point, it's not possible to decrypt messages sent to phone A. Unless...

For user experience reasons, WhatsApp will actively re-encrypt and re-send undelivered (one-checkmark ✔) messages to device B with the newly created keys. This is known as resend vulnerability.

WhatsApp asserted the key retransmission process is a design decision — intended to minimize the risk of messages being lost in transit when, for example, someone gets a new phone or swaps out their SIM.

To explain, the following happens. Please note that there is some simplification:

  1. Alice sends text to Bob, who is offline
  2. In order to do so, Alice gets Bob's public key from WA server. Specifically, she obtains a set of keys to use in the future
  3. Alice sends WA the encrypted messages and obtains the first check
  4. Charlie pwns Bob's account, and notifies WA server
  5. WA has still messages pending from Alice that can't be decrypted by Bob Charlie, so informs Alice
  6. Alice will pull the new keys for Bob Charlie. Since Alice has only one checkmark (message sent but not delivered), she assumes Bob never read those messages.
  7. Without user confirmation and before asking for additional identity checks, Alice re-encrypts and re-sends messages to Bob Charlie
  8. Bob Charlie downloads the new messages encrypted with Charlie's public keys
  9. Alice gets double checkmark (or even blue, if Bob Charlie allows)

However, it happens only for underlivered messages. It means that an attacker capable of taking control of the user account (e.g. SIM swap) is then capable of reading all undelivered messages but not che chat history

  • 1
    Again, I want to point out that it is a design choice by Facebook, not a flaw in the protocol itself. – usr-local-ΕΨΗΕΛΩΝ Sep 14 '20 at 12:54
  • I have never doubted the strength of the protocol . but only its implementation by whatsapp. Thanks for the explanation !! – Chidhambararajan NRM Oct 10 '20 at 2:58

Disclaimer: This is from memory, I haven not looked this up. Maybe if I have time later today, I will come back and update this answer.

I don't believe that the behaviour that you're seeing necessarily means that private keys are stored on the cloud; it could also mean that new devices are automatically sent the chat history from other devices.

The mental picture I have of the Signal protocol is that every chat has a symmetric AES key. Each device has its own RSA keypair. When you add a new device to a given chat (either you're adding a new person, or you're adding a new device for a person already in the chat), then one of the other clients already in the chat needs to take the AES key for that chat, and send it to the new participant using their RSA key.

  • Thanks for your response, looks like whatsapp is changing the private key pairs for each device, but their cloud backup isn't encrypted, then why do they claim that they themselves can't read through the messages – Chidhambararajan NRM Apr 7 '20 at 6:55
  • but their cloud backup isn't encrypted The cloud backup is stored on Google Drive / iCloud. WhatsApp has no access to them. Backup is optional – usr-local-ΕΨΗΕΛΩΝ Feb 15 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.