– WhatsApp End-to-End Encryption Signal, X3DH, Double Ratchet Algorithm & XEdDSA/VXEdDSA Michael Bolli, Patrick Kofmel 1.1, January 17, 2017 Module: BTI 7311 Computer Science Seminar Term: Autumn Term 2016/2017 Supervisor: Prof. Dr. Rolf Haenni Bern University of Applied Sciences Engineering and Information Technology Computer Science Abstract Right when the court fight between Apple and the FBI was at its highest point, WhatsApp came along, stating that they were turning on end-to-end encryption for their over 1 billion users. With this step, WhatsApp gained a lot of points with privacy advocates, but painted a pretty big target on its back for the US government. In this seminar paper, I will explain how the technology behind WhatsApp end-to-end encryption works. First, a few crypto primitives are illustrated, to provide some context or to serve as a reference. The emphasis though lies on the Signal Protocol, developed by Open Whisper Systems. The main topics there are the X3DH key exchange protocol, the Double Ratchet algorithm and the XEdDSA signature scheme. Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences 2 Table of contents 1 Introduction 4 2 Key concepts 4 3 Used crypto primitives and characteristics 5 3.1 Asymmetric/Public key crypto 5 3.2 Forward secrecy 5 3.3 Cryptographic deniability 5 3.4 Digital signatures 5 3.5 One-way hash function 5 3.6 Message authentication code 6 3.7 Diffie-Hellman key agreement protocol 6 3.8 HMAC based key derivation function HKDF 6 3.9 Authenticated Encryption with Associated Data AEAD 7 4 The Signal Protocol 8 4.1 Extended triple Diffie-Hellman key agreement protocol (X3DH) 8 4.1.1 Used keys and functions 8 4.1.2 The three phases 8 4.1.3 Setting overview 10 4.2 The Double Ratchet Algorithm 10 4.2.1 KDF Chains 11 4.2.2 Symmetric-key ratchet 12 4.2.3 Diffie-Hellman ratchet 12 4.2.4 Double Ratchet 13 4.3 The (V)XEdDSA Signature Scheme 14 4.3.1 XEdDSA 15 5 References 16 6 Versions 17 Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences 3 1 Introduction Since 2012, when messages sent by messaging apps overtook SMS texts for the first time (Bell, 2013), WhatsApp and other services got more and more under fire for their security issues. The NSA scandal didn’t help; encrypted messaging services like Threema and Telegram got popular quickly. WhatsApp silently introduced a “commercially reasonable” encryption in the middle of 2012, only for iOS and Android, though and without specifying the cryptographic methods, which brought more security analysts to the scene. Quickly it was deducted that this current encryption was not secure at all ([email protected], 2012; Kennell, 2012). From 2012 to 2014 even more vulnerabilities were found, e.g. the “WhatsApp Message Handler Vulnerability” which crashed the app when receiving a certain 2 KB message, or the “Photo Privacy Bug” after the introduction of WhatsApp Web (Khandelwal, 2014). It was high time then for WhatsApp to invest in reliable security. At the end of 2014 the partnership of WhatsApp and Open Whisper Systems was made official (Marlinspike, Open Whisper Systems partners with WhatsApp to provide end-to-end encryption, 2014). OWS developed the encrypted messaging app and same-named protocol TextSecure. Together they announced proper end-to-end encryption using TextSecure, which was soon renamed to Signal. In April of 2016 the companies announced availability of end-to-end encryption on all architectures and that users could verify each other’s keys. In this seminar paper, I will introduce the Signal Protocol, which is now also used by Facebook Messenger and Google Allo. As a reference, I will first describe some crypto terms for better understanding the protocol itself. 2 Key concepts Concept Description Crypto techniques Confidentiality Information is kept secret from all but (A)Symmetric Key Crypto authorized parties. Integrity Messages have not been modified in transit. Hash, HMAC, Signature Authentication The sender of a message is authentic. HMAC, Asymmetric Key Crypto, Signature Non-repudiation The sender of a message cannot deny the Asymmetric Key Crypto, creation of the message. Signature Freshness Messages cannot be replayed. Nonce, Perfect Forward Secrecy Trust Receiver can believe that the sender is who Certificates he says he is. Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences 4 3 Used crypto primitives and characteristics 3.1 Asymmetric/Public key crypto Two keys are used: A public key to be distributed, and a private key which must be kept private. If somebody wants to send me e.g. an encrypted e-mail, he uses my public key to encrypt it, and I use my private key to decrypt it. For this to be secure, it must be difficult to calculate a private key from its public key. In comparison to symmetric crypto, the key exchange doesn’t need to happen on a secure channel. In many cases, asymmetric crypto is used as a convenient way to securely transfer a session key for a subsequent symmetric encryption, which is much more efficient. This is called a hybrid cryptosystem. Public key algorithms are used in many known standards like TLS, S/MIME, PGP and GPG. With key distribution algorithms like Diffie-Hellman and signatures like DSA, public key crypto is fundamental for today’s crypto world. 3.2 Forward secrecy A cryptographic protocol has (perfect) forward secrecy if the compromise of long-term keys does not allow an attacker to obtain past session keys (Paar & Pelzl, 2010, p. 341). A system therefore needs to generate a new set of key agreement parameters for each session. These parameters can never be re-used and should never be stored. Now, an attacker managing to compromise a shared session secret would only compromise that particular session. 3.3 Cryptographic deniability It might be necessary for a sender of a message to deny sending that message, even if he was forced to give up the encryption key. Cryptographic deniability makes it impossible to prove the existence of the plaintext message without the right encryption key. This can be done by encrypting a message in such a way that using key 퐾퐴 to decrypt the cipher text results in another message than by using key 퐾퐵. 3.4 Digital signatures To prevent forgery or tampering with messages, digital signatures can be used to provide integrity, authentication, and non-repudiation. Digital signatures employ asymmetric cryptography and consist of the following three parts: Key generation, signing and verifying. The key generation algorithm outputs the private key and a corresponding public key. The signing algorithm takes a message and the private key to produce a signature. The verifying algorithm verifies the authenticity of the message using the public key and the signature. 3.5 One-way hash function A hash function calculates from an input message of any length, an output string of a fixed length. This means it needs to be deterministic, so the same message always results in the same hash. It is called a one-way function because the design makes it easy to compute the output from the input message, but very hard to generate an input message from its hash value. Another property is the so-called avalanche effect, which describes that even a minimal change to the message drastically changes the output hash. Hashes are used in many applications, these being digital signatures, message authentication codes (see below), fingerprinting and data integrity. Berner Fachhochschule | Haute école spécialisée bernoise | Bern University of Applied Sciences 5 3.6 Message authentication code A MAC consists of key generation, signing and verifying algorithms. MACs share some properties with digital signatures, as they also provide message integrity and authentication (but not non- repudiation). Due to the use of block ciphers or hash functions (which would be a HMAC) instead of asymmetric crypto, they are much more performant though. A MAC takes a secret key and a message as input, and calculates a MAC output. This enables a recipient/verifier to detect any changes to the message content by running the message through the same MAC function with the same key and finally comparing the resulting MACs. 3.7 Diffie-Hellman key agreement protocol The Diffie-Hellman key exchange enables two parties to calculate a common secret key by communicating over an insecure channel. Apart from Signal, it’s also used in many major ∗ protocols like SSH, TLS and IPsec. Its basic idea is that exponentiation in ℤ푝, 푝 prime, is a one- way function and that exponentiation is commutative (Paar & Pelzl, 2010, p. 206): 푘 = (훼푥)푦 ≡ (훼푦)푥 mod 푝 Using this idea, the protocol looks like this: Figure 1: Diffie-Hellman key agreement protocol (Schneider, 2016) Alice wants to establish a secret key with Bob through an insecure channel. In the set-up protocol the public parameters ∈ {2, 3, … , 푝 − 2} and a large prime 푝 are generated and published. Alice can then choose her private key 푎 ∈ {2, 3, … , 푝 − 2}, and calculate her public key 퐴 = 푎 mod 푝. Alice sends the public key to Bob, which after his calculations does the same. With this public key, they can now each generate a joint secret key: 퐾 ≡ (퐵)푎 mod 푝 ≡ 푏푎 mod 푝 ≡ (퐴)푏 mod 푝 ≡ 푎푏 mod 푝 This key K can now be used for further communications e.g. with a symmetric key cipher like AES or 3DES. 3.8 HMAC based key derivation function HKDF A key derivation function (KDF) is a basic and essential component of cryptosystems.