0

I was wondering if a server enforces E2EE, should the users provide any kind of authentication?

Indeed, if the data is encrypted, any user could access it but the only person who can actually decrypt and read the content of the message is the person who knows the private key. Why would they need to authenticate themselves?

It is a bit like the way ENIGMA messages were broadcasted via radio, but no one could understand the content.

Why does an E2EE messaging app needs user authentication?

1 Answer 1

0

if the data is encrypted, any user could access it but the only person who can actually decrypt and read the content of the message is the person who knows the private key

True. But, what do you have to loose by authenticating the user? If your system only serves the ciphertext if the user proves that he/she is in possession of the private key, then this adds this second layer of security, this becomes more of a 'defense in depth' solution.

If your system serves the ciphertext to anyone that requests it, this can open the door to offline brute force attacks, where an attacker may be successful in brute forcing the private key (for example, if the private key was derived from a weak password using a weak key derivation function). By authenticating the user before serving the ciphertext, your system can mitigate this threat, because attempts can be rate-limited.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .