# How WhatsApp users authenticate themselves in end-to-end encryption?

I read the WhatsApp Security Whitepaper and I want to know how a user A, which uses ECDH (Elliptic Curve Diffie-Hellman) to compute a master_secret, can be sure that the public keys for the recipient B used in the exchange belong to B and they have not been replaced by someone else. A uses B (public) Identity Key, Signed Pre Key and One-Time Pre Key, all stored on the server at the moment of B's registration: how can A be sure that they are actually his recipient's keys?

(ECDH is an anonymous protocol, therefore authentication must be achieved someway else)

• This has been answered over on Security.SE. – mikeazo Sep 19 '16 at 16:48
• Comments are not for extended discussion; this conversation has been moved to chat. – e-sushi Sep 19 '16 at 21:34

• @JigarJoshi, yeah, basically, with DH (whether it is EC or not), I can create a bunch of public values ($g^a$) that I publish on a server. If you then want to complete the exchange, you send to me $g^b$ and use my $g^a$ to compute $g^{ab}$. Turn that into the symmetric key to encrypt the message, and send the encrypted message to me. I then look up the $a$ value, use your $g^b$ to compute $g^{ab}$, and I can decrypt your message. By signing the $g^a$ values (e.g., $g^{a_1},g^{a_2},\dots,g^{a_n}$) that I've uploaded to the server, you have assurance that they are mine. I know the private value. – mikeazo Nov 2 '16 at 11:49
• To understand how you combine two "public keys" to make a symmetric key, you have to understand Diffie-Hellman. The public keys we are talking about are very different from what you typically think of when you think about RSA, for example. Also, I provided an example in my previous comment. If you receive $g^b$ and you know $a$, you can compute $g^{ab}$. If the other party knows $b$ and is given $g^a$, they can also compute $g^{ab}$. From that shared secret value you can derive a symmetric key. – mikeazo Nov 3 '16 at 12:01