End-to-end encryption: what is End-to-End Encryption (E2EE)

Messenger unveiled the end -to -end encryption function in October 2016. WhatsApp has used it since April 2016. Although the two services were part of the Facebook group at the time, which has since become meta, the choice of the default application was made for WhatsApp, but not for Messenger. A decision immediately criticized in the name of personal security and protection.

Understand everything – what is end -to -end encryption, which must protect our private conversations

Facebook intends to apply by default end -to -end encryption in 2023. This decision follows an abortion case where the company transmitted a young woman’s messages to the police.

Since August 8, the Celeste Burgess case, accused of having aborted illegally in the United States, has been strongly publicized. The reason? Facebook provided the police with the discussions of the 17 -year -old woman, who made it possible. A few days later, on August 11, the company announced that end -to -end encryption would be applied by default from 2023.

• What is the end -to -end encryption?

This function makes it possible to secure digital exchanges. Applicable to written, audio or video messages, it ensures that only people integrated into a conversation can access messages. The data transmitted by the transmitters is instantly encrypted and can only be read by the recipients, using a encryption key.

This method is opposed to the transfer of data in clear text, in particular used when sending SMS. In this case, anyone could potentially intercept these exchanges and have access to them. End -to -end encryption therefore ensures that no person outside a conversation can discover the content.

• What applications offer this default service?

The Moderator Blog List of messaging services offering default encryption. The best known – Signal, Telegram or WhatsApp – are obviously part of it. But the site indicates other solutions. In particular the French applications Olvid and Skred or Wire, founded by the co-creator of Skype.

• Are there limits to end-to-end encryption?

The supplier of Kapersky antivirus solutions specifies in a blog post that quantified exchanges can still be traced. If the conversations remain secure and no one is able to decipher them, the sending and reception information can be found. Thus, it is possible to know that an individual has sent a message such day, at such a time, to such a person. Without having the encryption key, the server will however retain the temporality of exchanges and the identity of transmitters and recipients.

• Why the abortion case relaunched the debate on the subject?

When Facebook received a search warrant to obtain the exchanges of Celeste Burgess, she was under an investigation for making a miscarriage and made the body of her stillborn child disappear. But during the analysis of his Facebook data, the Nebraska authorities discovered that it was actually an illegal abortion. The charges against the 17 -year -old woman therefore allocated following the involvement of the social network in the case.

This is the first case where a woman’s personal data have been used against her since the revocation of the right to abortion in the United States. Despite everything, it should be noted that the facts, intervened in April, and the request of the authorities with Facebook, on June 7, preceding the decision of the US Supreme Court, June 24.

However, the Nebraska abortion case describes the worst scenario that human rights associations feared. Since the revocation, they have continued to request more protection around personal data. Thus reviving the debate on the need for end -to -end encryption of conversations.

• Facebook has announced its default encryption in response to the case?

Officially, there is no link between the two events. Facebook explained that the search mandate did not indicate that the authorities were carrying out an investigation for abortion. If the announcement of default encryption on Messenger was made in the wake of events, it would not be a reaction, according to Martin Signoux. On Twitter, Meta’s public affairs manager in France recalled that the date of 2023 had already been cited long before the survey against Celeste Burgess.

Indeed, at the end of 2021, Antigone Davis, the World Security Manager at Meta, explained in a forum published by The Telegraph: “We take our time to do things well and we do not plan to finish the global deployment of end -to -end encryption by default on all our messaging services before 2023.»

Nevertheless, the company’s press releases on end -to -end encryption published since these remarks have never mentioned this date of 2023 before this August 11. Or three days after media coverage of Nebraska abortion.

• why the application of default encryption is not unanimous?

Messenger unveiled the end -to -end encryption function in October 2016. WhatsApp has used it since April 2016. Although the two services were part of the Facebook group at the time, which has since become meta, the choice of the default application was made for WhatsApp, but not for Messenger. A decision immediately criticized in the name of personal security and protection.

At the same time, an opposition was also formed to plead in favor of the transparency of the messages sent to Facebook. For six years, children’s safety defenders have claimed that end -to -end encryption would protect pedocriminals in the event of contact with minors. Although young Americans aged 13 to 17 seem to desert the social network, the argument remains perfectly heard.

In June 2019, the US government had even thought of prohibiting the encryption of personal data. The authorities regretted no longer having access to conversations in the context of a police inquiry.

Only problem, the revocation of the right to abortion in the United States gives weight to the need for the application of default encryption. It would thus be used to protect pregnant women wishing to abort.

End-to-end encryption: what is End-to-End Encryption (E2EE)

End -to -end encryption has become the standard of messaging applications.

Héloïse Famié-Galtier / published on August 16, 2021 at 11:52 am

End -to -end encryption, how it works ?

Also called end-to-end Encryption or E2EE, end-to-end encryption ensures that only transmitter and recipient are able to have access to exchanged messages. When a message is sent, it is automatically encrypted and you need a key to decipher it. Only interlocutors have these cryptographic keys. They are ephemeral and disappear as soon as a message is deciphered by its receiver. This system guarantees exchanges without the intervention of an intermediary, the server by which messages transit only to relay their encrypted version. It can convey a message but cannot decode it, since it does not have the keys.

End -to -end encryption is thus a secure system that allows you to protect yourself from monitoring or falsification of messages. No third -party service can decipher the data communicated or stored, not even the communication service provider.

An essential system on messaging applications

Today, end -to -end encryption is used by all messaging, WhatsApp to Telegram via signal or Facebook Messenger applications. This system which guarantees the integrity of exchanges by messages has even become a guarantee of quality for users. Beyond the messages, it is also the vocal and video calls that are encrypted from start to finish. This is evidenced by the latest Facebook announcements who wishes to offer users calls for quantified audio and video from start to finish on Messenger, but also for DMs on Instagram.

In another register, the use of end -to -end encryption can create controversy. In November 2020, the European Council aimed at end -to -end email and wished the creation of backdoors (or stolen doors) which would allow the authorities to bypass the encryption of messaging, in particular to fight against terrorism. More recently, it was Apple who created controversy by engaging in the fight against pedocrime. The company wishes to bypass end -to -end encryption by implementing a certain number of actions to identify sensitive content on iOS and iPados, calling into question the confidentiality of private correspondence.

End -to -end

End -to -end encryption (E2EE) is a secure communication process that prevents third parties from accessing data transferred from one end point to another

Meaning of end -to -end encryption

data encryption is the process using an algorithm that transforms standard text characters into an illegible format. This process notably uses encryption keys to blur data so that only authorized users can read it. End -to -end encryption also uses this same process. However, it goes further by securing communications from one end point to another.

Learn more about data encryption
End -to -end encryption and transit encryption

In many messaging services, third parties store the data, which are only encrypted. This server -side encryption method secures data from all unauthorized consultations only. But this method means that the transmitter can consult the information also, which can be undesirable in cases where the protection of personal information on all points is required.

In the case of end -to -end encryption, encrypted data can only be visualized by people with deciphering keys. In other words, the E2Ee prohibits unwanted users, including third parties, to read or modify the data when only authorized readers must have this access and possibility.

Importance of end -to -end encryption

E2EE is used in particular when confidentiality is of the utmost importance. Examples of confidentiality include sensitive subjects such as commercial documents, financial information, legal procedures, medical states or personal conversations. Consequently, do not manage to secure private data could cause damage to business business and their customers.

End -to -end encryption can secure data against cyber attacks. In 2020 for example, the average cost of data protection involvement was $ 3.86 million worldwide and $ 8.64 million in the United States. These costs include expenses related to detection and response to data protection involvement, the cost of unavailability and income loss, as well as the long -term reputation of a business and her brand. And in the event of personally identifiable information compromise, this may lead to a loss of confidence of customers, fines for breach of the regulations, or even legal actions.

End -to -end encryption offers more than sending encrypted messages. It may also make it possible to control the authorization of user access to stored data. A centralized system for strategy management for privileged users provides granular control of people with access as well as information to which they have access. Associated with a centralized key management system that respects the key management interoperability protocol (KMIP), organizations can encrypt and protect data at all levels.

What is a cyber-attack ?
Use of end -to -end encryption
Secure communications

Messaging applications such as signal and the Tetra digital mobile radio standard use end -to -end to preserve the confidentiality of conversations between its users. Electronic messaging systems can also be configured for E2EE, but this requires a PGP (Pretty Good Privacy) encryption configuration). Users can also use a service such as Protonmail and Tutanota, which have an integrated PGP.

Password management

Pass managers such as 1Password, Bitwarden, Dashlane and Lastpass use the E2EE to protect a user’s passwords. In this case, however, the user is at two ending points and is the only person with a key.

Storage devices often provide E2EE to rest. However, service providers can also offer transit E2EE in a cloud storage parameter, protecting user data from any person, including cloud service provider.

Operation of end -to -end encryption

End -to -end encryption begins with cryptography, a method of protecting the information which transforms them in an non -readable format called quantified text. Only users with a secret key can decipher, or decrypt, the text message in clear. With the E2EE, the transmitter or the creator crypt data, and only the recipient or the reading program can decipher them.

Asymmetrical or public encryption is a figure and decipher data using two cryptographic keys. The public key is used to encrypt a message and send it to the owner of the public key. Then, the message can only be deciphered using a corresponding private key, also called deciphering key. For example, the Encryption Protocol TLS (transport Layer Security) prevents third parties from intercepting transit messages.

In the management of passwords and mobile digital radio (Tetra), the user is both an costume and the decipher. For example, with Tetra end -to -end encryption, receivers generate encryption keys using a key management center (KMC) or key management installation (KMF). Then they collect the encrypted data for deciphering.

Symmetrical encryption is a type of encryption where a single symmetrical secret key is used to encrypt the text in clear and decipher the encrypted text.

What is encryption ?
Challenges of the E2ee Security of the final nodes

The E2EE figures only the data between the termination points. This fact means that the end points themselves are vulnerable to an attack. Consequently, companies implement the security of termination points in order to protect data beyond transit.

Find out more about the security of the end nodes attacks of the environment (MITM)

IT pirates can enter between two termination points, listen to secretly and intercept messages. They simulate the access rights of the planned recipient, swap the deciphering keys and transmit the message to the real recipient without being detected.

Find out more about the attacks of the middle man (MITM) stolen doors

Whether companies incorporate or not stolen backpasted doors into their encryption systems, computer hackers can enter and use them to infringe the negotiation of keys or bypassing encryption.

Learn more about the cost of data violation
Data encryption protection

Unprotected corporate data can be viewed, stolen, deleted or modified. But with IBM Security ™, you can protect your data and your organization from damage.

Discover the protection solutions by encryption
Homomorphic encryption services

Totally homomorphic encryption (FHE) can help you take advantage of the value of your sensitive data on unprecedented areas without deciphering them.

Explore homomorphic encryption services
Data violation protection solutions

Strengthen personal information, optimize customer confidence and develop your business with IBM personal information protection solutions.

Browse personal information protection solutions
Secure server and storage solutions

A delay in infrastructure update can make you vulnerable to threats. Apply a security -oriented approach to your hybrid cloud infrastructure.

Explore infrastructure security solutions
Rançongiciel protection solutions

The ransom is more sophisticated than the typical malware, using reinforced encryption to exploit the disclosed vulnerabilities. Are you protected ?

Protect your data against ransom attacks
Systematic encryption

Improve the protection and confidentiality of data by encrypting each stage of their life cycle (transmission, storage and processing) with IBM Z® solutions.

Explore omnipresent encryption solutions
Centralized management of the keys life cycle

Centralize, simplify and automate key management with IBM Security Guardium Key Lifecycle Manager.

Manage the keys with centralized management of the keys life cycle
Flash storage solutions

Simplify data management and infrastructure with the family of unified IBM FlashSystem® platforms, which rationalizes administration and operational complexity in on -site environments, hybrid, virtualized and containerized cloud.

Explore flash storage solutions
IBM security framework and discovery workshop resources

Understand your cybersecurity environment and prioritize initiatives with IBM senior architects and consultants during a free, virtual or person, 3 -hour design thinking session,.

What is data encryption ?

Find out what data encryption is, what are the types and advantages, and to what extent it allows you to protect your data.

Find out more about the encryption of latest news data on data protection

Compliance with regulations such as the ACCP and the General Data Protection Regulations (GDPR) to protection of assets by encryption, discover the latest innovations concerning data protection and confidentiality.

Read the latest news on data protection why important data security ?

Find out what data security is, why it is important, data security types and more.

Find out more about data security X-Force Threat Intelligence Index

Understand the risks of cyber attack thanks to a global view of the context of threats.

Cost of data violation

The cost of a data violation explores financial benefits and security measures that can help your organization avoid violation of data or, if it could not be avoided, to reduce costs.