2
$\begingroup$

E2EE can be established in Whatsapp by scanning the QR-code on the other person’s phone.

But I read on the FAQ page that this code / number can also be sent to the other person via SMS, Email, etc.

Isn’t it possible to establish an E2EE without this «increased» effort? Are they trying to make it difficult for the users? Because as far as I know the computers for an internet connection do these sort of things without these weird methods that Whatsapp uses.

Are there any advantages in scanning a QR-code?

$\endgroup$
  • $\begingroup$ Scanning QR codes is likely to happen during a face-to-face meeting, which is really the only way to verify someones identity. SMS/Email are vulnerable to man-in-the-middle attacks. $\endgroup$ – conchild Sep 7 '18 at 16:25
  • 1
    $\begingroup$ As far as I remember, in WhatsApp E2EE is active by default. The scanning procedure is simply a method for the user to be sure that it actually is. $\endgroup$ – M-elman Sep 7 '18 at 20:29
3
$\begingroup$

Are there any advantages in scanning a QR-code?

Yes.
But to understand why this provides an advantage we first need to introduce the man-in-the-middle attack (MitM attack). In this attack setup, the adversary sits between you and your communication partner and you are doing your cryptographic computations (the key exchange) with the adversary who then initiates a key exchange with your intended partner and then forwards (some) of your messages to make sure you don't notice the attack. It needs to be noted that you indeed are having a session with the attacker and not with your intended recipient in this case which in particular means two things:

  • You will see the adversary's public key and not your intended target's and
  • You will share the agreed key with the adversary and not with your intended target.

On the web, i.e. when you browse websites this is mitigated by so-called certificates which effectively state in a trust-worthy manner "this public key belongs to this entity". Then an adversary can't go ahead and send his public key as the entity's key because he can't come up with the statement / certificate.

However in this scenario, i.e. instant messaging you can't have one central source which says "this key belongs to X" if you don't trust the service provider which end-to-end encryption (E2EE) is all about. So we need another way to ensure that we are actually directly communicating with our intended target. This is where the additional QR-code / number come in. They are essentially a processed version of your public key and the other party's public key. Now if you transmit this information to your intended target in an authentic manner and the information matches you know that you are using their public key and thus that there is no active attack going on.

| improve this answer | |
$\endgroup$
  • $\begingroup$ So the main problem would be that there are no certificates for phones? $\endgroup$ – AleksanderRas Sep 7 '18 at 19:22
  • 1
    $\begingroup$ @AleksanderRassasse the problem is rather that you have no universally trusted instance to issue these because this instance would be in a position to break E2E encryption. $\endgroup$ – SEJPM Sep 7 '18 at 20:36
0
$\begingroup$

I did some further research about it:

E2EE is always enabled in Whatsapp and there's no way to turn off E2EE.

This QR-code is just to verify that this chat is indeed protected by E2EE.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.