How can Whatsapp identify forwarded attachments

Question

Sometimes Whatsapp shows that an attachment was often forwarded.

How do they know this if the message is end-to-end encrypted? Even with hybrid encryption I encrypt with my key and store my attachment on the server.

So do they hash the attachment in the client and store the hash? So they would know what attachments I forwarded and when?

Answer 1

The attachments are processed as follows (source is the WhatsApp's White Paper);

First time of the attachment is sent

1. The sender generates a 32-byte random AES-256 key, $k_1$, and another random 32-byte key $k_2$ for $\operatorname{HMAC-SHA256}$
2. Encrypts the attachment $a$ with this key $c_a = \operatorname{AES-CBC-256}(k_1,a)$ and append the MAC of the $c_a = \operatorname{HMAC-SHA256}(k_2)$ to it.
3. The sender uploads this to the server in a blob store.
4. The sender encrypts the $k_1,k_2$, and SHA256 hash of the encrypted blob and URL of the blob to the receiver.
5. The receiver decrypts the message, receives the encrypted blob, verifies the SHA256 of it, verifies the MAC then decrypts it.

This is a media caching technique.

The attachment is forwarded

The receiver wants to forward the message;

• Encrypt the URL and the key $k_1,k_2$, and SHA256 hash of the attachment that is received from the sender and forwards to someone else.

How can Whatsapp identify forwarded attachments

Simply add a "forwarded" tag into the message that contains the $k_1,k_2$, and SHA25 of the attachment. Even forwarding has a counter to limit the fan out and WhatsApp doesn't know about it.

So do they hash the attachment in the client and store the hash? So they would know what attachments I forwarded and when?

Not because of it, they don't the internal of the messages, however, the blob has stored in the WhatsApp server contains enough information to execute a traffic analysis if they want to execute.

• Store this information; who uploaded the blob; when the blob is uploaded.
• Store who wants to access this blob and when.

Now, the attacker can make graphs.

This is traffic analysis doesn't expose the message, however, if one of the receivers is breached the circulated attachment can give information about others.