Deploying key transparency at WhatsApp
Apr 13, 2023Sean Lawlor, Kevin Lewi

Summary
Introduced a new key transparency feature for WhatsApp to automatically verify end-to-end encrypted connections. This is achieved by maintaining an append-only Auditable Key Directory (AKD) of public keys mapped to user accounts, with changes recorded in a publicly available, privacy-preserving audit record. An open-source Rust library (AKD crate) was developed to support this, enabling clients to validate key authenticity and anyone to verify audit proofs. The system addresses the challenges of manual security code verification in 1:1 and group communications by providing an automated, scalable, and auditable mechanism.
More from the Application Security and Permissions trail
- How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees
- Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study
- Labyrinth 1.1: Making End-to-End Encrypted Backups Even More Reliable
- How Meta Is Strengthening End-to-End Encrypted Backups
- Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways