Score:6

Introduce a reference for cryptanalysis of WhatsApp software

us flag

I am studying on cryptanalysis of WhatsApp software. I know this is secure software but I want to present a documentary on this topic as a seminar at the university for applied mathematics students.

As you know, WhatsApp is based on the Signal protocol, and for this reason, I first focused on the structure of this protocol. The first document I studied was this master's thesis.

The advantage of this master thesis is its explanation through pictures. The downside is the fact that the author did not explain some important facts about the Signal protocol mathematically.

For example, section 3.1.3 is about the Diffie-Hellman Ratchet, but I can't get the concept of Ratchet from the pictures in this section (for instance this picture). In fact, I'm really curious about the mathematical difference between Diffie-Hellman and Diffie-Hellman Ratchet.

Please let me to make an example to illustrate what I mean when I say that I am eager to know Diffie Hellmann Racht mathematically. The structure of Diffie Hellman is as follows:

  • For Diffie-Hellman procedure, let $g$ and $p$ are public. Alice chooses $a$ and computes $A=g^a$ mod $p$ and sends it to Bob. Bob selects $b$ and calculates $B=g^b$ mod $p$ and sends it to Alice. Finally the key is $K=A^b$ mod $p=B^a$ mod $p$.

My question:

I would like to ask you to introduce me a reference about cryptanalysis of WhatsApp software. Especially in the case of attacks on WhatsApp (or Signal protocol) as well as in the case of information leakage in WhatsApp.

Thanks for any help

user0410 avatar
ph flag
I suggest you read [this article](https://ieeexplore.ieee.org/abstract/document/8406614/authors#authors) and its citations carefully. It may be useful.
us flag
Also of interest: [Signal licensed their software to WhatsApp back in 2014](https://signal.org/blog/whatsapp/), which means that you can, for the E2EE part, read and search for Signal instead of WhatsApp. As an example, there's [advanced cryptographic ratcheting](https://signal.org/blog/advanced-ratcheting/) on Signal's blog.
user3571 avatar
us flag
@RubenDeSmet Useful comment. Thanks
user3571 avatar
us flag
@user0410 Thank you very much for your gift.
us flag
Seems like it's your lucky day: [WhatsApp just released a new white paper](https://scontent.whatsapp.net/v/t39.8562-34/241394876_546674233234181_8907137889500301879_n.pdf/WhatsApp_Security_Encrypted_Backups_Whitepaper.pdf?ccb=1-5&_nc_sid=2fbf2a&_nc_ohc=XhVTjVGfRagAX8rykfP&_nc_ht=scontent.whatsapp.net&oh=09b54601888e3da5a9387aa77ce2b260&oe=6140577C)
user3571 avatar
us flag
@RubenDeSmet Thank you for your notification. Based on your comment the link in the question is updated.
Score:7
ag flag

(This answer pertains to Signal protocol, which underlies applications like Signal and WhatsApp. As far as I know, WhatsApp software is not open source and therefore it is hard to ascertain whether/how they actually implement the Signal protocol. The source-code of Signal application is, on the other hand, available.)

On a high level, the Signal protocol builds on the off-the-record messaging protocol [BBG]. The security analysis of Signal protocol for end-to-end messaging (compared to the protocol for group messaging, which is addressed below) was carried out in [CCG,CCDGS,B+]$^*$. Briefly, these works realised that the core component of the signal protocol is a cryptographic primitive called (unidirectional) ratcheted key exchange/ratcheted encryption (you can read more about ratchets in this post). A ratcheted key-exchange (e.g., Diffie-Hellman ratchet) protocol, in addition to the guarantees provided by a vanilla key exchange protocol (e.g., Diffie-Hellman and its derivatives like MQV), provides security properties like forward secrecy and post-compromise (or backward) security. Further analysis of ratcheted key-exchange was carried out in [PR,ACD]: they strengthened the results in [CCG,CCDGS,BCJNS] to take into account bidirectional or double ratchets.

The group messaging protocol used in Signal/WhatApp, is being currently standardised by IETF: see MLS working group for latest updates. The underlying protocol is called continuous group key agreement$^{**}$ and it aims to extend the ratcheting key exchange -- which is limited to two users -- to dynamic groups with multiple users. One of the main goals here is to have the communication complexity of the protocol scale sub-linearly with the number of members in the group.$^{***}$ You can read more about the security analysis of the proposal (which build on protocols called ART [CCGMM] and TreeKEM [BBR]) in [ACCKKPW,ACDT] and the papers they refer to.

$^*$ You can read more about the differences between the results in [CCG,CCDGS,BCJNS] in the related works section of [CCDGS] and [BCJNS]

$^{**}$ The end-to-end ratcheting key exchange is also sometimes referred to as continuous key agreement.

$^{***}$ Group ratchets can be simulated using end-to-end ratchets if one does not care about the blow-up in communication complexity.

[ACCKKPW]: Alwen et al, Keep the Dirt: Tainted TreeKEM, Adaptively and Actively Secure Continuous Group Key Agreement, EuroS&P 2021

[ACD]: Alwen, Coretti and Dodis, The Double Ratchet: Security Notions, Proofs, and Modularization for the Signal Protocol, Eurocrypt 2019

[ACDT]: Alwen, Coretti, Dodis and Tselekounis, Security Analysis and Improvements for the IETF MLS Standard for Group Messaging, Crypto 2020

[BCJNS] Bellare et al, Ratcheted Encryption and Key Exchange: The Security of Messaging, Crypto 2017

[BBR] Barnes, Bhargavan and Rescorla, TreeKEM: Asynchronous Decentralized Key Management for Large Dynamic Groups

[BBG] Borisov, Brewster and Goldberg, Off-the-Record Communication, or, Why Not To Use PGP, CCS 2004

[CCDGS]: Cohn-Gordon et al, A Formal Security Analysis of the Signal Messaging Protocol, EuroS&P 2017

[CCGMM]: Cohn-Gordon et al, On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees, CCS 2018

[CCG]: Cohn-Gordon, Cremers and Garett, Post-Compromise Security, CSF 2016

[PR]: Poettering and Rössler, Asynchronous ratcheted key exchange, Crypto 2018

user3571 avatar
us flag
An amazing answer. I appreciate you taking the time to answer the question. I'm looking forward to more details. Thanks in advance.
user3571 avatar
us flag
Please let me to request you to introduce related thesis in this subject as well. Also I would appreciate it if you could let me know about [this reference](https://ieeexplore.ieee.org/abstract/document/8406614/authors#authors) that is suggested by OP.
ckamath avatar
ag flag
@user3571: the referred paper seems to be about *group* messaging (which is addressed in the second part of the answer) rather than *end-to-end* messaging (which only involves two parties).
user3571 avatar
us flag
Thanks you for all your help in introducing new references. Certainly I will read carefully all suggested references and thesis. I also have to choose an article on WhatsApp cryptoanalysis and translate it into my own language. As a final request, I ask you to help me select the right reference for this topic. Thank you in advance for your attention to this matter.
ckamath avatar
ag flag
@user3571: on a quick glance, the thesis seems well-researched. There has been further research after it was written though.
user0410 avatar
ph flag
A complete and well-written answer. Good job and thanks for your effort.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.