End-to-end encryption


End-to-end encryption is a system of communication where only the communicating users can read the messages. In principle, it prevents potential eavesdroppers – including telecom providers, Internet providers, and even the provider of the communication service – from being able to access the cryptographic keys needed to decrypt the conversation.
In many messaging systems, including email and many chat networks, messages pass through intermediaries and are stored by a third party, from which they are retrieved by the recipient. Even if the messages are encrypted, they are only encrypted 'in transit', and are thus accessible by the service provider, regardless of whether server-side disk encryption is used. This allows the third party to provide search and other features, or to scan for illegal and unacceptable content, but also means they can be read and misused by anyone who has access to the stored messages on the third party system, whether this is by design or via a backdoor. This can be seen as a concern in many cases where privacy is very important, such as persons living under repressive governments, whistleblowing, mass surveillance, businesses whose reputation depends on its ability to protect third party data, negotiations and communications that are important enough to have a risk of targeted 'hacking', and where sensitive subjects such as health, and information about minors are involved.
End-to-end encryption implements TLS which is intended to prevent data being read or modified, other than by the true sender and recipient. The messages are encrypted by the sender but the third party should not have a means to decrypt them.
No third parties should be able to decipher the data being communicated over TL, E2EE concepts must extend to data storage also, for example, companies that use E2EE are unable to hand over plain text data of their customers' to the authorities.

Etymology of the term

The term "end-to-end encryption" originally only meant that the communication is never decrypted during its transport from the sender to the receiver.
For example, around 2003, E2EE has been proposed as an additional layer of encryption for GSM or TETRA, in addition to the existing radio encryption protecting the communication between the mobile device and the network infrastructure. This has been standardised by SFPG for TETRA. Note that in TETRA E2EE, the keys are generated by a Key Management Centre or a Key Management Facility, not by the communicating users.

Later, around 2014, the meaning of "end-to-end encryption" started to evolve, requiring that not only the communication stays encrypted during transport, but also that the provider of the communication service is not able to decrypt the communications either by having access to the private key, or by having the capability to undetectably inject an adversarial public key as part of a man-in-the-middle attack. This new meaning is now the widely accepted one in popular communities, the information security industry standards remain unchanged, academic research tends to focus on new modern use cases for E2EE leaving the well defined proven use cases unchanged, and information security education programs such as the ICS CISSP certification continues to define E2EE as it has always been. Information security professionals have made attempts to popularise a new terminology attempting to address specific concerns with little success in preserving the E2EE meaning.

Key exchange

In an E2EE system, encryption keys must only be known to the communicating parties. To achieve this goal, E2EE systems can encrypt data using a pre-arranged string of symbols, called a pre-shared secret, or a one-time secret derived from such a pre-shared secret. They can also negotiate a secret key on the spot using Diffie-Hellman key exchange.

Modern usage

As of 2016, typical server-based communications systems do not include end-to-end encryption. These systems can only guarantee the protection of communications between clients and servers, meaning that users have to trust the third parties who are running the servers with the sensitive content. End-to-end encryption is regarded as safer because it reduces the number of parties who might be able to interfere or break the encryption. In the case of instant messaging, users may use a third-party client or plugin to implement an end-to-end encryption scheme over an otherwise non-E2EE protocol.
Some non-E2EE systems, such as Lavabit and Hushmail, have described themselves as offering "end-to-end" encryption when they did not. Other systems, such as Telegram and Google Allo, have been criticized for not having end-to-end encryption, which they do offer, enabled by default. Telegram did not enable end-to-end encryption by default on VoIP calls while users were using desktop software version, but that problem was fixed quickly. However, as of 2020, Telegram still features no end-to-end encryption by default, no end-to-end encryption for group chats, and no end-to-end encryption for its desktop clients.
Some encrypted backup and file sharing services provide client-side encryption. The encryption they offer is here not referred to as end-to-end encryption, because the services are not meant for sharing messages between users. However, the term "end-to-end encryption" is sometimes incorrectly used to describe client-side encryption.

Challenges

Man-in-the-middle attacks

End-to-end encryption ensures that data is transferred securely between endpoints. But, rather than try to break the encryption, an eavesdropper may impersonate a message recipient, so that messages are encrypted with a key known to the attacker. After decrypting the message, the snoop can then encrypt it with a key that they share with the actual recipient, or their public key in case of asymmetric systems, and send the message on again to avoid detection. This is known as a man-in-the-middle attack.

Authentication

Most end-to-end encryption protocols include some form of endpoint authentication specifically to prevent MITM attacks. For example, one could rely on certification authorities or a web of trust. An alternative technique is to generate cryptographic hashes based on the communicating users’ public keys or shared secret keys. The parties compare their fingerprints using an outside communication channel that guarantees integrity and authenticity of communication, before starting their conversation. If the fingerprints match, there is in theory, no man in the middle.
When displayed for human inspection, fingerprints usually use some form of Binary-to-text encoding. These strings are then formatted into groups of characters for readability. Some clients instead display a natural language representation of the fingerprint. As the approach consists of a one-to-one mapping between fingerprint blocks and words, there is no loss in entropy. The protocol may choose to display words in the user's native language. This can, however, make cross-language comparisons prone to errors.
In order to improve localization, some protocols have chosen to display fingerprints as base 10 strings instead of more error prone hexadecimal or natural language strings. An example of the base 10 fingerprint would be
37345 35585 86758 07668
05805 48714 98975 19432
47272 72741 60915 64451
Modern messaging applications can also display fingerprints as QR codes that users can scan off each other's devices.

Endpoint security

The end-to-end encryption paradigm does not directly address risks at the communications endpoints themselves. Each user's computer can still be hacked to steal his or her cryptographic key or simply read the recipients’ decrypted messages both in real time and from log files. Even the most perfectly encrypted communication pipe is only as secure as the mailbox on the other end. Major attempts to increase endpoint security have been to isolate key generation, storage and cryptographic operations to a smart card such as Google's Project Vault. However, since plaintext input and output are still visible to the host system, malware can monitor conversations in real time. A more robust approach is to isolate all sensitive data to a fully air gapped computer. PGP has been recommended by experts for this purpose: However, as Bruce Schneier points out, Stuxnet developed by US and Israel successfully jumped air gap and reached Natanz nuclear plant's network in Iran. To deal with key exfiltration with malware, one approach is to split the Trusted Computing Base behind two unidirectionally connected computers that prevent either insertion of malware, or exfiltration of sensitive data with inserted malware.

Backdoors

A backdoor is usually a secret method of bypassing normal authentication or encryption in a computer system, a product, or an embedded device, etc. Companies may also willingly or unwillingly introduce backdoors to their software that help subvert key negotiation or bypass encryption altogether. In 2013, information leaked by Edward Snowden showed that Skype had a backdoor which allowed Microsoft to hand over their users' messages to the NSA despite the fact that those messages were officially end-to-end encrypted.

Compliance and regulatory requirements for content inspection

While E2EE can offer privacy benefits that make it desirable in consumer-grade services, many businesses have to balanced these benefits with their regulatory requirements. For example, many organizations are subject to mandates that require them to be able to decrypt any communication between their employees or between their employees and third parties.
This might be needed for archival purposes, for inspection by Data Loss Prevention systems, for litigation-related eDiscovery or for detection of malware and other threats in the data streams. For this reason, some enterprise-focused communications and informaiton protection systems might implement encryption in a way that ensures all transmissions are encrypted with the encryption being terminated at their internal systems so can have access to the information for inspection and processing.