Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
When I download Naver Line PC client onto my PC, a six-digit number will be shown on the PC client for me to enter the number into my Line app on my mobile phone for decrypting the old and new messages. Once I do so, I can receive and send messages to any other endpoints.
How does Naver Line send my private key stored on my phone to the PC client?
Converting a lengthy comment exchange to an answer:
How does Naver Line send my private key stored on my phone to the PC client?
LINE has provided a technical whitepaper which described how message end-to-end encryption was done. https://scdn.line-apps.com/stf/linecorp/en/csr/line-encryption-whitepaper-ver1.0.pdf Since that whitepaper provides technical details about the communication protocols and encryption algorithms integrated into LINE’s messaging and VoIP platform, and since repeating what they wrote in their whitepaper doesn't make sense, I just have to ask: What information within that PDF didn't you understand? Why doesn't their own information satisfy your needs?
The whitepaper does not explain how the PC client obtains the private key from the mobile device. Please suggest if you find it in the whitepaper
What you describe in your Q (a code that shows on PC which you have to enter on mobile) is verifying your identity on the PC version of LINE.
Your PC version then gets all the needed data via their servers. As the PDF explains on page 11 (4.2.1) In order to be able to send encrypted messages, each LINE client application generates a Letter Sealing ECDH key pair, and saves it securely in the application’s private storage….
So, your PC doesn't simply get your mobile keys and use those — it uses it's own keys to securely exchange data (incl. what's needed to decrypt other encrypted messages).
Since your question describes the authentication/authorisation process of setting up a new client device, and since the "keys" part you ask about is described in their PDF, it's pretty unclear to me what exactly you're asking since everything you mention is already be covered by their whitepaper (as well as their website, which contains the same infos using layman's terminology).
Are you saying that the the private key on my phone is not private as Line can retrieve it for purposes or Line keeps my private key on Line server for their future use. This is not E2EE from my point of view and contradicts to the information on whitepaper on page 16.
No, I'm saying that they use your individual device's keys to securely exchange secrets from device to device (… as the whitepaper explains).
Mobile = keypair 1, PC = keypair 2, etc. Using those public key encryption keys, it's very well possible to exchange secrets (like private keys) between your devices in a secure E2E manner. In case of doubt, read up on how public key encryption works.
Line PC could sync previous messages from mobile device even when the mobile is offline. It can’t be done by using different keys
Because those encrypted messages are stored on their servers.
Note that while you enter the PC authorisation/authentication code (they call it "verification code") into mobile, you not only authorize your PC but are also online — which is a perfect time to sync keys between devices, so that you can read your older messages on your new device.
Once this initial key sync is done (should take not more than a few KBs, so it's done in a few secs while you're authorizing your new device), you are able to read all old messages on your new device even when all your other devices are offline from that moment on.
Actually, that's similar to how 99.999% of the secure E2E messaging apps do it when they offer multi-device access to old/stored encrypted messages stored on a 3rd-party server.
Besides all that, of should be noted you're asking about (what they call) "Letter Sealing", which uses unique, user-specific encryption keys which allow users to safely and securely send messages to one another. Their user-account specific keys are more restricted (according to their website) which is one of the reasons their help center mentions Can I use the same account on more than one device? With the smartphone version of LINE, the same account cannot be used on multiple devices. Only one phone number or email address can be used to verify one account per device. If you register the same phone number on a different device, the account on your previous device will automatically be deleted and you will no longer be able to use it. You can use the same account on the PC and iPad versions of LINE by logging in with the same email address.
Now, please don't get me wrong, but it may be advisable for you to read up on how public key encryption generally works, before diving into things which might be hard to grasp when not knowing which practical solutions public key encryption can offer in alike scenarios.
Nota Bene: This answer is solely based on the PDF documentation and website information which has been made available to the general public by the specific messaging service provider. The answer is not meant to indicate or imply a full-fledged assessment of theoretical and/or practical security. The answer should therefore not be interpreted or referred to as such a security assessment.
