WhatsApp end-to-end encrypted backups announced for Android and iOS

Published

3 years ago

September 10, 2021

Deng Li

On September 10, 2021, WhatsApp end-to-end encrypted backups is officially announced for Android and iOS devices. This feature allows you to further strengthen and safeguard privacy for message backups.

Adding to the existing online backup options, the new end-to-end encrypted (E2EE) disables both WhatsApp or the backup service to read your backup content or your backup encryption key.

So how does WhatsApp end to end encryption works?

The new WhatsApp end-to-end encrypted backups work is based on WhatsApp E2EE and WhatsApp explains that to make this feature work, the chat app maker has developed a new system for encryption key storage that works with both iOS and Android. The backup then be encrypted with a unique random encryption key. You will also have an option to generate this key randomly or via a user password.

When someone opts for a password, the key is stored in a Backup Key Vault that is built based on a component called a hardware security module (HSM) — specialized, secure hardware that can be used to securely store encryption keys.

When the account owner needs access to their backup, they can access it with their encryption key, or they can use their personal password to retrieve their encryption key from the HSM-based Backup Key Vault and decrypt their backup.

The HSM-based Backup Key Vault will be responsible for enforcing password verification attempts and rendering the key permanently inaccessible after a minimal number of unsuccessful attempts to access it.

These security measures provide protection against brute-force attempts to retrieve the key. WhatsApp will know only that a key exists in the HSM. It will not know the key itself.

New Process:

When you use a personal password to protect your WhatsApp end-to-end encrypted backups, the HSM based backup key vault will store the key and secure it by registering it with the backup key vault.

If some tries to access your backup:

They enter their password, which is encrypted and then verified by the Backup Key Vault.
Once the password is verified, the Backup Key Vault will send the encryption key back to the WhatsApp client.
With the key in hand, the WhatsApp client can then decrypt the backups.
Alternatively, if an account owner has chosen to use the 64-digit key alone, they will have to manually enter the key themselves to decrypt and access their backups.