From 90f4427c411e57538e9404a4cc133a3560ac366b Mon Sep 17 00:00:00 2001 From: Nischit Ekbote Date: Fri, 17 Jul 2026 13:07:50 +0530 Subject: [PATCH 1/2] Adds a new blog on WhatsApp end-to-end encryption --- .../blog/whatsapp-end-to-end-encryption.md | 325 ++++++++++++++++++ 1 file changed, 325 insertions(+) create mode 100644 content/blog/whatsapp-end-to-end-encryption.md diff --git a/content/blog/whatsapp-end-to-end-encryption.md b/content/blog/whatsapp-end-to-end-encryption.md new file mode 100644 index 0000000..2cae1b6 --- /dev/null +++ b/content/blog/whatsapp-end-to-end-encryption.md @@ -0,0 +1,325 @@ +--- +title: "How WhatsApp Ensures Only the Recipient Can Read Your Messages" +authorIds: ["nischit"] +date: 2026-07-17 +draft: false +featured: true +weight: 1 +--- + +# How WhatsApp Ensures Only the Recipient Can Read Your Messages + +Every day, billions of messages are exchanged over WhatsApp. These messages travel through Wi-Fi routers, Internet Service Providers (ISPs), mobile towers, and WhatsApp's own servers before reaching the recipient. + +Yet, despite all these intermediaries, WhatsApp claims that **only the sender and the recipient can read the messages**. Not WhatsApp. Not your ISP. Not someone intercepting your network traffic. + +How is that possible? + +Let's understand what happens behind the scenes every time you press **Send**. + +> **Note:** This article is a conceptual explanation of WhatsApp's end-to-end encryption. Some implementation details of the Signal Protocol have been simplified to keep the focus on the core ideas. + +--- + +## The Problem + +Imagine Alice wants to send Bob a simple message. + +```text +Hello Bob! +``` + +If Alice sends this directly over the internet, anyone capable of observing the traffic could read it. + +Clearly, plaintext communication isn't secure. + +The obvious solution? + +**Encrypt the message before sending it.** + +--- + +## Why AES Alone Isn't Enough + +AES (Advanced Encryption Standard) is one of the fastest and most secure symmetric encryption algorithms available today. + +Conceptually: + +```text + Plaintext + │ + ▼ +AES(Key, IV, Plaintext) + │ + ▼ + Ciphertext +``` + +Only someone with the same secret key can decrypt the ciphertext. + +But this introduces a new problem. + +How does Bob obtain that secret key? + +If Alice simply sends the AES key over the internet, an attacker can intercept it and decrypt every future message. + +This is known as the **Key Distribution Problem**. + +--- + +## Public Key Cryptography + +To solve the key distribution problem, WhatsApp uses the **Signal Protocol**, which combines asymmetric and symmetric cryptography. + +When Bob installs WhatsApp, his phone generates: + +- Public Key +- Private Key + +The public key is made available through WhatsApp's servers so other users can establish secure communication. + +The private key never leaves Bob's device. + +Anyone can know Bob's public key. + +Only Bob knows his private key. + +--- + +## Creating a Shared Secret + +WhatsApp uses **Elliptic Curve Diffie–Hellman (ECDH)**. + +Alice computes a shared secret using: + +- Alice's Private Key +- Bob's Public Key + +Bob computes a shared secret using: + +- Bob's Private Key +- Alice's Public Key + +Although the inputs are different, both devices independently arrive at the **same shared secret**. + +The shared secret is **never transmitted** across the network. + +--- + +## Deriving the Initial Encryption Keys + +Because both devices begin with the same shared secret, HKDF deterministically derives the same initial encryption keys on both devices without ever transmitting them. + +```text + Shared Secret + │ + ▼ + HKDF + │ + ▼ +Initial Encryption Keys +``` + +--- + +## Encrypting the First Message + +Every message is encrypted using the current message key, a fresh IV (nonce), and the plaintext. + +- Current Message Key +- Fresh IV (Nonce) +- Plaintext + +```text + Message Key + │ + │ +Fresh IV ─── AES-GCM ───► Ciphertext + ▲ + │ + Plaintext +``` + +The IV is **not secret** and is sent along with the ciphertext. + +Its purpose is to ensure that encrypting the same plaintext twice produces different ciphertext. + +--- + +## Why Every Message Uses a Different Key + +Does WhatsApp repeat ECDH for every message? + +No. + +ECDH establishes the initial shared secret. + +After that, the Signal Protocol's **Double Ratchet Algorithm** derives a fresh message key after each encrypted message. + +After a message is encrypted and successfully processed, both devices advance the Double Ratchet to derive the next message key. + +Because both devices maintain the same cryptographic state, they independently derive identical message keys without ever transmitting them. + +```text +Initial Shared Secret + │ + ▼ + HKDF + │ + ▼ + Message Key 1 + │ + HKDF + ▼ + Message Key 2 + │ + HKDF + ▼ + Message Key 3 +``` + +Each message therefore uses: + +- A new message key +- A fresh IV (Nonce) + +This provides **Forward Secrecy**—compromising one message key does not reveal previous messages. + +--- + +## WhatsApp's Role + +A common misconception is that WhatsApp encrypts your messages. + +It doesn't. + +Your device encrypts the message before it reaches WhatsApp. + +```text + Alice + │ +Encrypted Message + │ +WhatsApp Server + │ +Encrypted Message + │ + Bob +``` + +WhatsApp only stores and forwards encrypted packets. + +Since it never possesses the message keys, it cannot read your conversations. + +--- + +## Reading the Message + +Bob receives: + +- Ciphertext +- IV (Nonce) + +Bob independently derives the same message key using the Signal Protocol. + +Using that message key together with the transmitted IV (nonce), he decrypts the ciphertext back into the original plaintext. + +```text + Ciphertext + │ +Message Key + IV + │ + ▼ + AES-GCM + │ + ▼ + Hello Bob! +``` + +The original plaintext is recovered. + +--- + +## Putting It All Together + +```text + Bob's Public Key + │ + ▼ + ECDH + │ + ▼ + Shared Secret + │ + ▼ + HKDF + │ + ▼ + Message Key + │ + ▼ + ┌─────────────────┐ + │ AES-GCM │ + │-----------------│ + │ Inputs: │ + │ • Message Key │ + │ • Plaintext │ + │ • IV (Nonce) │ + └─────────────────┘ + │ + ▼ + Ciphertext + │ + ▼ + WhatsApp Server + │ + ▼ + Bob +``` + +--- + +## Conclusion + +WhatsApp combines asymmetric and symmetric cryptography to achieve secure communication. + +- ECDH establishes a shared secret. +- HKDF derives encryption keys. +- The Double Ratchet continuously derives fresh message keys. +- AES-GCM encrypts every message. +- WhatsApp only forwards encrypted packets. + +Every message you send follows this process within milliseconds. + +Behind every "Hi", "How are you?", or "See you tomorrow" is a carefully engineered cryptographic protocol designed so that only the intended recipient can read your message. + +--- + +## Glossary + +### ECDH (Elliptic Curve Diffie–Hellman) +A key exchange algorithm that allows two devices to independently compute the same shared secret without ever transmitting it over the network. + +### HKDF (HMAC-based Key Derivation Function) +A cryptographic function that derives one or more strong encryption keys from a shared secret. + +### AES-GCM +A mode of operation for AES that provides both confidentiality (encryption) and integrity (tamper detection). + +### IV (Initialization Vector) / Nonce +A unique value used during encryption to ensure that encrypting the same plaintext twice produces different ciphertext. It is transmitted alongside the ciphertext and does not need to remain secret. + +### Double Ratchet Algorithm +The key management algorithm used by the Signal Protocol that derives a fresh message key for every encrypted message, providing forward secrecy and post-compromise security. + +### Shared Secret +A secret value independently computed by two devices during ECDH. Both devices compute the same value without ever sending it across the network. + +### Forward Secrecy +A security property where compromising a current encryption key does not allow an attacker to decrypt previously sent messages. + +### Signal Protocol +The end-to-end encryption protocol used by WhatsApp. It combines ECDH, HKDF, the Double Ratchet Algorithm, and AES-GCM to provide secure messaging. + +### End-to-End Encryption (E2EE) +A communication model in which only the sender and the intended recipient can decrypt the messages. Intermediate servers can forward encrypted data but cannot decrypt or read its contents. \ No newline at end of file From d0e07059ab744f225b89ce565fe0b295f41f3dc3 Mon Sep 17 00:00:00 2001 From: Nischit Ekbote Date: Fri, 17 Jul 2026 13:13:20 +0530 Subject: [PATCH 2/2] Improve WhatsApp end-to-end encryption blog --- content/blog/whatsapp-end-to-end-encryption.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/content/blog/whatsapp-end-to-end-encryption.md b/content/blog/whatsapp-end-to-end-encryption.md index 2cae1b6..628de5e 100644 --- a/content/blog/whatsapp-end-to-end-encryption.md +++ b/content/blog/whatsapp-end-to-end-encryption.md @@ -7,8 +7,6 @@ featured: true weight: 1 --- -# How WhatsApp Ensures Only the Recipient Can Read Your Messages - Every day, billions of messages are exchanged over WhatsApp. These messages travel through Wi-Fi routers, Internet Service Providers (ISPs), mobile towers, and WhatsApp's own servers before reaching the recipient. Yet, despite all these intermediaries, WhatsApp claims that **only the sender and the recipient can read the messages**. Not WhatsApp. Not your ISP. Not someone intercepting your network traffic. @@ -298,28 +296,37 @@ Behind every "Hi", "How are you?", or "See you tomorrow" is a carefully engineer ## Glossary ### ECDH (Elliptic Curve Diffie–Hellman) + A key exchange algorithm that allows two devices to independently compute the same shared secret without ever transmitting it over the network. ### HKDF (HMAC-based Key Derivation Function) + A cryptographic function that derives one or more strong encryption keys from a shared secret. ### AES-GCM + A mode of operation for AES that provides both confidentiality (encryption) and integrity (tamper detection). ### IV (Initialization Vector) / Nonce + A unique value used during encryption to ensure that encrypting the same plaintext twice produces different ciphertext. It is transmitted alongside the ciphertext and does not need to remain secret. ### Double Ratchet Algorithm + The key management algorithm used by the Signal Protocol that derives a fresh message key for every encrypted message, providing forward secrecy and post-compromise security. ### Shared Secret + A secret value independently computed by two devices during ECDH. Both devices compute the same value without ever sending it across the network. ### Forward Secrecy + A security property where compromising a current encryption key does not allow an attacker to decrypt previously sent messages. ### Signal Protocol + The end-to-end encryption protocol used by WhatsApp. It combines ECDH, HKDF, the Double Ratchet Algorithm, and AES-GCM to provide secure messaging. ### End-to-End Encryption (E2EE) -A communication model in which only the sender and the intended recipient can decrypt the messages. Intermediate servers can forward encrypted data but cannot decrypt or read its contents. \ No newline at end of file + +A communication model in which only the sender and the intended recipient can decrypt the messages. Intermediate servers can forward encrypted data but cannot decrypt or read its contents.