Abu Zar Mishwani
End-to-end encryption (E2EE) is a secure way of communicating that ensures only the intended users can access the information being sent. It protects data during its journey from one device to another, preventing third parties from intercepting or reading the content.
In end-to-end encryption (E2EE), the information gets encrypted on the sender’s device, and only the intended receiver has the ability to decrypt it. Throughout its journey to the destination, the message remains unreadable and untouched by internet service providers, application service providers, hackers, or any other external entities or services.
Several widely used messaging platforms, such as Facebook, WhatsApp, and Zoom, use end-to-end encryption (E2EE). However, the adoption of this technology by these providers has sparked controversy.
This is because end-to-end encryption makes it challenging for these services to share user information with authorities, raising concerns about the potential for private messaging to be misused by individuals involved in illegal activities.
How Does End-to-End Encryption Work?
The keys for encrypting and decrypting messages are kept on the communicating devices. This method involves the use of public key encryption.
The public key, or asymmetric encryption, relies on a pair of keys: a public key, which can be shared openly, and a private key. When someone shares the public key, others can utilize it to encrypt a message and send it to the owner of the public key. The only way to decrypt the message is by using the corresponding private key, also known as the decryption key.
In online communications, messages often pass through an intermediary, typically a server owned by an ISP, a telecommunications company, or other organizations. Public key infrastructure in end-to-end encryption ensures that these intermediaries cannot eavesdrop on the messages being exchanged.
To guarantee the authenticity of a public key as the genuine key of the intended recipient, it is embedded in a certificate digitally signed by a reputable certificate authority (CA).
The trustworthiness of the CA’s widely recognized and distributed public key ensures reliability; a certificate signed by this public key is deemed authentic. Since the certificate links the recipient’s name with the public key, it is presumed that the CA would not sign a certificate associating a different public key with the same name.
Example of How E2EE Encryption Works
Suppose Ali wants to send a private message to Imad using a messaging app that uses E2EE.
- Key Exchange: Ali and Imad each have a pair of keys: a public key and a private key. They keep their private keys secret and share their public keys.
- Ali Sends Encrypted Message: Ali writes a message to Imad and encrypts it using Imad’s public key. This means only Imad, with his private key, can decrypt and read the message.
- Message Transmission: The encrypted message is sent over the internet. Even if someone intercepts the message during transmission, they won’t understand it without Imad’s private key.
- Imad Decrypts Message: Imad receives the encrypted message and uses his private key to decrypt it, revealing Ali’s original message.
When Imad wants to reply to Ali, he encrypts his message using Ali’s public key, and the process repeats. Only Ali can decrypt the message using his private key.
Throughout this process, the messages remain encrypted and unreadable to anyone except Ali and Imad, ensuring their conversations remain private and secure.
How is End-To-End Encryption Different From Other Types of Encryption?
Some messaging apps claim to have secure communication by encrypting messages while they travel from the sender to the app’s server and then from the server to the receiver.
However, there’s a catch: the message gets briefly decrypted when it reaches the server before being encrypted again. This happens with a common encryption method called TLS.
Think about a postal service that, after getting your letter to deliver, opens it up, puts the letter in a different envelope, and then sends it to the person you wrote to. This means the postal workers might see what’s written in the letter.
The service might say they won’t read your message in its original form, similar to the postal service in our example promising not to read letters during the transfer. However, if you use the service, you have to trust that they’ll keep their word.
E2EE is called “end-to-end” because a third party cannot decrypt the communication. It is not necessary for users to have trust that the service they are using won’t read their communications since it is not capable of doing so.
Consider the scenario where a letter was sent in a locked box to which only the sender had the key instead of an envelope. Beyond the intended receiver, it would now be physically impossible for anybody else to read the letter. That’s how E2EE works.
Which Encryption Technology is Used By E2EE?
Public key encryption, commonly known as asymmetric encryption, is a particular type of encryption used in end-to-end encryption. This type of encryption allows two parties to communicate securely without sharing their secret key through an unsecured channel.
Public key encryption works by using two keys: a public key and a private key. The public key is visible to everyone, even the messaging service, while only one person holds the private key. Information encoded with the public key can only be decoded using the private key, not the public one.
Note: This is different from symmetric encryption, where the same key is used for both encryption and decryption.
How is End-To-End Encryption Used?
End-to-end encryption is used in situations where maintaining the security of data is crucial, such as in finance, healthcare, and communications. It’s a common choice for companies aiming to adhere to data privacy and security regulations and laws.
For example, an electronic point-of-sale (POS) system provider might include E2EE in its offering to protect sensitive data, such as client credit card information. The Payment Card Industry Data Security Standard (PCI DSS), which requires that card numbers, magnetic stripe data, and security codes not be stored on client devices, would also be easier for retailers to comply with if E2EE was implemented.
E2EE vs.TLS: What’s The Difference?
Transport Layer Security (TLS) is a protocol that relies on public key encryption, similar to end-to-end encryption (E2EE). It guarantees that no middlemen can read the messages being sent.
Yet, it’s important to note that TLS operates between a user and a server, not directly between two users. While it ensures data security in transit to and from a server, the information stored on the server remains decrypted.
This decryption is necessary for functionalities like web applications, where the server needs access to user data. However, from a privacy perspective, this may not be ideal for certain situations. For instance, when users wish to exchange messages, they might prefer a system where the service provider cannot access or view their messages.
How Does End-To-End Encryption Protect Confidentiality?
End-to-end encryption (E2EE) guarantees that only the two individuals communicating can access their messages as long as their devices remain secure and uncompromised.
When implemented correctly, it eliminates the need for users to rely on a service’s commitment to handling their data responsibly. E2EE essentially empowers individuals with complete control over the privacy of their messages, allowing them to keep their conversations entirely private.
Limitations of End-To-End Encryption (E2EE)
End-to-end encryption (E2EE) keeps messages secure while being sent but doesn’t protect them once they arrive.
Imagine Ali and Imad using an E2EE app. If Ishmal steals Imad’s phone, she can access Ali’s messages. Alternatively, Ishmal might peek over Imad’s shoulder or attempt to infect Imad’s phone with malware to read Ali’s messages. E2EE alone doesn’t guard against these types of attacks.
End-to-end encryption (E2EE) is not assured to be future-proof. While current encryption methods are robust against powerful computers, the advancement of technology may pose a challenge. Future quantum computers, if developed, could potentially break modern encryption algorithms. E2EE provides security for messages now, but its long-term security is not guaranteed.