What is Encryption?
- Encryption is a way of protecting data from unauthorised access or tampering. It works by transforming the data into a secret code that only the intended recipient can decipher. This comes in useful for various cases, such as securing online communications, storing sensitive information, and verifying digital identities.
- There are two main types of encryption: symmetric and asymmetric.
- Symmetric encryption uses the same key to encrypt and decrypt the data.
- Asymmetric encryption uses a pair of keys: one public and one private. The public key can be shared with anyone, but the private key must be kept secret.
What is end-to-end encryption?
- End-to-end encryption protects data as it’s transferred between locations – which is crucial wherever there’s a rapid exchange of information, like in WhatsApp.
- In an E2EE-enabled app, only the folks on each end – the sender and receiver – can read any exchanged messages. Not even the messaging service provider.
- This is because messages get encrypted on the user's device before being sent and only are decrypted when they reach the intended recipient. So one gets complete privacy from snoopers, hackers, and even the company whose service one is using.
How does end-to-end encryption work?
- The key element is asymmetric cryptography, which uses pairs of keys – public and private – to secure communications. The public key encrypts data, while the private key decrypts it.
- Users on an end-to-end encrypted system like WhatsApp each generate their own public-private key pairs. They widely distribute their public keys, which act like open locks anyone can use to send them encrypted messages. But those messages can only be unlocked and read by someone holding the associated private key.
- For example, say Alice wants to send Bob a secret message. Alice retrieves Bob’s public key from his profile or a trusted key server. She encrypts her message using Bob’s public key and sends the text to Bob. Bob receives the encrypted message and uses his private key to decrypt it. The private key is closely guarded on his device and known only to him. This creates a secure channel only accessible to the endpoints in the conversation.
Can a third party gain access to a private key?
- The private keys cannot be hacked. This is because the private key is stored only on the user’s device and cannot be shared with anyone else. Meanwhile, the public key is stored on the server, but it cannot be used to decrypt the messages. Therefore, even if a hacker or a service provider breaches the server, they cannot read the messages or access the private key.
Benefits of end-to-end encryption:
- The core benefit of E2EE is privacy. When done correctly, it prevents anyone except the sender and recipient from accessing the contents of a message. This protects users from hackers, criminals, overreaching governments, and even the companies providing the services. It enables free and open communication without fear of reprisal.
Concerns:
- E2EE enables criminal or terrorist coordination. The law enforcement and national security agencies argue that the technology hampers their ability to detect dangerous or illegal activities.
- The technical drawbacks include that E2EE requires more computing resources and makes certain functions like search prohibitively difficult.