WhatsApp has announced this end-to-end encryption now in order to prepare the broader technical community with the new approach
WhatsApp has introduced end-to-end encryption even for chat back-ups. Earlier, the lack of encryption for backups could provide a loophole to malicious actors. WhatsApp claims that with the introduction of end-to-end encryption for chat back-ups, it has become the only large-scale messaging service to provide this level of security for people’s messages – from sending and transit, to receiving and storing in the cloud.
How the new feature will be rolled out
WhatsApp has announced this end-to-end encryption now in order to prepare the broader technical community with the new approach before it’s available to beta testers and eventually to everyday users.
WhatsApp new feature will be released as an optional feature and in the coming weeks, the instant messaging platform will be rolling this out to iOS and Android users.
How does it work
Currently, WhatsApp’s backup management relies on mobile device cloud partners, such as Apple and Google, to store backups of the WhatsApp data (chat messages, photos, etc.) in Apple iCloud or Google Drive. Prior to the introduction of end-to-end encrypted backups, backups stored on Apple iCloud and Google Drive were not protected by WhatsApp’s end-to-end encryption.
Now, the instant messaging platform will offer the ability to secure backups with end-to-end encryption before they are uploaded to these cloud services. With the introduction of end-to-end encrypted backups, WhatsApp has created an HSM (Hardware Security Module) based Backup Key Vault to securely store per-user encryption keys for user backups in tamper-resistant storage, thus ensuring stronger security of users’ message history.
With end-to-end encrypted backups enabled, before storing backups in the cloud, the client encrypts the chat messages and all the messaging data (i.e. text, photos, videos, etc) that is being backed up using a random key that’s generated on the user’s device.
Where will the key be stored
The key to encrypt the backup is secured with a user-provided password. The password is unknown to WhatsApp, the user’s mobile device cloud partners, or any third party. The key is stored in the HSM Backup Key Vault to allow the user to recover the key in the event the device is lost or stolen.
The HSM Backup Key Vault is responsible for enforcing password verification attempts and rendering the key permanently inaccessible after a certain number of unsuccessful attempts to access it.
