The world of cryptography is starting to really intrigue me admittedly. I initially hated it because it looked too hard Mathematically but now it looks cool :)

Got a good question for the experts and nerds on this forum. I got like a feeling that WhatsApp works by making use of public keys and private keys encryption. That would mean that Sender A would send a message to Sender B using Sender Bs public key. My question is, where would the private key of this recipient be stored, like within their account?

Also, how would the whole key thing work in a WhatsApp group as there are multiple users involved?

Like I said, I am just interested and want to hear from the experts here

up vote 1 down vote accepted

I got like a feeling that WhatsApp works by making use of public keys and private keys encryption.

That's correct, WhatsApp uses Curve25519.

My question is, where would the private key of this recipient be stored, like within their account?

The keys are generated client-side, so they should be stored on your phone.

Also, how would the whole key thing work in a WhatsApp group as there are multiple users involved?

According to their paper:

Traditional unencrypted messenger apps typically employ “server-side fan-out” for group messages. A client wishing to send a message to a group of users transmits a single message, which is then distributed N times to the N different group members by the server.

This is in contrast to “client-side fan-out,” where a client would transmit a single message N times to the N different group members itself.

The exact procedure

The first time a WhatsApp group member sends a message to a group:

  1. The sender generates a random 32-byte Chain Key.

  2. The sender generates a random Curve25519 Signature Key key pair.

  3. The sender combines the 32-byte Chain Key and the public key from the Signature Key into a Sender Key message.

  4. The sender individually encrypts the Sender Key to each member of the group, using the pairwise messaging protocol explained previously.

For all subsequent messages to the group:

  1. The sender derives a Message Key from the Chain Key, and updates the Chain Key.

  2. The sender encrypts the message using AES256 in CbC mode.

  3. The sender signs the ciphertext using the Signature Key.

  4. The sender transmits the single ciphertext message to the server, which does server-side fan-out to all group participants.

The “hash ratchet” of the message sender’s Chain Key provides forward secrecy . Whenever a group member leaves, all group participants clear their Sender Key and start over.

Important here is point number 4:

The sender individually encrypts the Sender Key to each member of the group, [...].

If you need even more details then you can click here to download their whitepaper.

  • 1
    Thanks for explaining this to me :). As a sign of appreciation, I have also marked this answer as accepted. Thanks – Benza Jackpuut Oct 31 at 15:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.